ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Qlib's StaticDataLoader component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability allows remote attackers to execute arbitrary code on affected systems.

• zerodayinitiative.com/advisories/ZDI-26-848/ (opens in a new tab)

• ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-02
• ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-02
• What exploited vulnerabilities have in common: A data-driven analysis of real-world attacksAnalysis2026-11-02
• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02
• CVE-2026-98432: Linux kernel IPv4 TCP use-after-free IssueHighVulnerability2026-10-31