VulnerabilityPublished 11 Nov 2026

ZDI-26-947: (0Day) Meta FAIRChem make_submission_file NPZ File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 11 Nov 2026, 17:26 UTC

What to do

AI-suggested

Until a fix is available, users should avoid opening untrusted NPZ files or visiting untrusted webpages related to Meta FAIRChem. Monitor official vendor channels for updates.

Description

A remote code execution vulnerability exists in Meta FAIRChem's make_submission_file NPZ file parsing functionality. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file. The vulnerability has a high severity rating with a CVSS score assigned by ZDI of 7.8.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on the target system, potentially leading to full system compromise. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious webpage.

Summary

This vulnerability in Meta FAIRChem involves deserialization of untrusted data during NPZ file parsing in the make_submission_file component. Remote attackers can exploit this flaw to execute arbitrary code on affected systems if the user interacts with malicious content. The Zero Day Initiative assigned a CVSS rating of 7.8, indicating a high-severity remote code execution risk.

References

zerodayinitiative.com/advisories/ZDI-26-947/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 11 Nov 2026, 17:26 UTC

References

Community reviews

Related threats