ZDI discloses two unpatched Meta fairseq code-injection zero-days
What's new
First merged summary.
Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI
ZDI published two unpatched Meta fairseq code-injection flaws, both scored CVSS 7.8, with no CVE or fix.
ZDI published two zero-day advisories for Meta fairseq: ZDI-26-913 in load_audio_path and ZDI-26-917 in load_speaker. Both are unpatched code-injection flaws that ZDI scores CVSS 7.8. Remote attackers can execute arbitrary code if a user visits a malicious page or opens a malicious file. ZDI gives no CVE identifiers, affected versions, or fixed versions.
Key facts
- ZDI-26-913 affects Meta fairseq load_audio_path and is marked a zero-day.
- ZDI-26-917 is code injection in Meta fairseq load_speaker.
- Both advisories carry a ZDI CVSS score of 7.8.
- Exploitation requires a malicious page visit or opening a file.
- No CVE, affected version, or fix is stated for either flaw.
Timeline
dated events in the reporting · oldest first- Nov 11, 2026ZDI publishes ZDI-26-913 and ZDI-26-917 fairseq advisories · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesIdentifies both unpatched load_audio_path and load_speaker zero-days.
- Vendors
- Meta
- Products
- fairseq
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 14h ago
ZDI Published AdvisoriesFirst report
Meta fairseq load_audio_path flaw can run code (ZDI-26-913)
ZDI rates the unpatched issue 7.8; the user must visit a malicious page or open a file.
- · 14h ago
fairseq load_speaker zero-day enables remote code execution
ZDI-26-917 scores the unpatched load_speaker code-injection flaw CVSS 7.8 and requires a malicious page or file.