Skip to main content
VulnerabilityPublished

ZDI-26-940: (0Day) Meta fairseq dump_km_label Deserialization of Untrusted Data Remote Code Execution Vulnerability

Source Zero Day Initiative

0
Severity
High

Rated High by Zero Day Initiative

Data as of 11 Nov 2026, 17:27 UTC

What to do

AI-suggested

In the absence of an official fix, users should exercise caution when opening files or visiting untrusted web pages related to Meta fairseq. Monitor official Meta channels for updates and patches.

Description

A remote code execution vulnerability exists in Meta fairseq's dump_km_label deserialization process. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating of 7.8 by ZDI.

References

Community reviews

Loading reviews…