ZDI-26-799: Meta FAIRChem Solvent Deserialization of Untrusted Data Remote Code Execution Vulnerability

Meta FAIRChem contains a deserialization vulnerability that allows remote attackers to execute arbitrary code if a user interacts with malicious content such as a crafted webpage or file. This vulnerability requires user interaction for exploitation and has been assigned a high severity rating by the Zero Day Initiative.

• zerodayinitiative.com/advisories/ZDI-26-799/ (opens in a new tab)

• ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-794: Meta FAIRChem ion_db_path Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-795: Meta FAIRChem reaction_db_path Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-796: Meta FAIRChem reaction adsorbate_db_path Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26