ZDI-26-806: Meta FAIRChem write_top_k_vasp Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Meta FAIRChem's write_top_k_vasp component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8 by the Zero Day Initiative.

• zerodayinitiative.com/advisories/ZDI-26-806/ (opens in a new tab)

• GCP-2025-044MediumVulnerability2026-10-26
• ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-794: Meta FAIRChem ion_db_path Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26
• ZDI-26-795: Meta FAIRChem reaction_db_path Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-26