VulnerabilityPublished
ZDI-26-909: (0Day) Meta Detectron2 CfgNode.merge_from_file Deserialization of Untrusted Data Remote Code Execution Vulnerability
Source Zero Day Initiative
0
Severity
HighRated High by Zero Day Initiative
Data as of 11 Nov 2026, 16:51 UTC
What to do
AI-suggested
Until a fix is available, users should avoid opening untrusted files or visiting suspicious web pages that could trigger this vulnerability.
Description
A remote code execution vulnerability exists in Meta Detectron2's CfgNode.merge_from_file function, allowing remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability has a high severity rating of 7.8 by ZDI.
References
Community reviews
Loading reviews…