ZDI-26-946: (0Day) Meta FAIRChem make_challenge_submission_file NPZ File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Meta FAIRChem's make_challenge_submission_file NPZ file parsing functionality. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating of 7.8 by ZDI.

• zerodayinitiative.com/advisories/ZDI-26-946/ (opens in a new tab)

• ZDI-26-935: (0Day) Meta fairseq FConvModelSelfAtt YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-936: (0Day) Meta fairseq FairseqCPUAdam YAML File Parsing Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-937: (0Day) Meta fairseq quantize_with_kmeans Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-938: (0Day) Meta fairseq parse_manifest Code Injection Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-939: (0Day) Meta fairseq2 FileCheckpointManager _load_state_dict Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11