ZDI publishes two unpatched Meta fairseq code-injection zero-days
First merged summary.
ZDI disclosed two unpatched Meta fairseq code-injection flaws rated 7.8, both requiring a user to open a malicious page or file.
Trend Micro’s Zero Day Initiative published two zero-day advisories for Meta fairseq on the same day: ZDI-26-915 in FilterNamesDataset and ZDI-26-942 in rerank. Both are unpatched code-injection bugs that can let a remote attacker run arbitrary code if a user visits a malicious page or opens a malicious file. ZDI assigned each a CVSS score of 7.8. The published snippets state no CVE identifiers, affected versions, or fixes.
- ZDI-26-915 covers FilterNamesDataset code injection in Meta fairseq.
- ZDI-26-942 covers a rerank code-injection flaw in Meta fairseq.
- Both advisories are marked zero-day and rated CVSS 7.8.
- Exploitation requires visiting a malicious page or opening a malicious file.
- Snippets give no CVE, affected version, or fixed version.
Timeline
dated events in the reporting · oldest first- Nov 11, 2026ZDI publishes two unpatched Meta fairseq zero-days · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesNames both ZDI-26-915 and ZDI-26-942, components, and CVSS 7.8.
- Vendors
- Meta
- Products
- fairseq
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 14h ago
ZDI Published AdvisoriesFirst report
Meta fairseq FilterNamesDataset flaw allows remote code execution
ZDI rates the unpatched FilterNamesDataset code-injection bug 7.8; a user must open a malicious page or file.
- · 14h ago
Meta fairseq rerank code injection enables remote code execution (ZDI-26-942)
ZDI rates the unpatched fairseq flaw CVSS 7.8; a victim must open a malicious file or page.