ZDI-26-939: (0Day) Meta fairseq2 FileCheckpointManager _load_state_dict Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Meta fairseq2's FileCheckpointManager _load_state_dict function. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has been assigned a high severity rating of 7.8 by the Zero Day Initiative.

• zerodayinitiative.com/advisories/ZDI-26-939/ (opens in a new tab)

• ZDI-26-927: (0Day) Meta fairseq FairseqAdam YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-928: (0Day) Meta fairseq W2lConvGluEncoder YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-929: (0Day) Meta fairseq FairseqAdamax YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-930: (0Day) Meta fairseq LightConvLanguageModel YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-931: (0Day) Meta fairseq AudioModalityConfig YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11