Meta's fairseq Library Hit by Critical Code Execution Vulnerability
A critical remote code execution vulnerability in Meta's fairseq library, disclosed by Zero Day Initiative, allows attackers to run arbitrary code on affected systems.
A critical remote code execution (RCE) vulnerability has been disclosed in Meta's fairseq library, a popular toolkit for sequence modeling used in natural language processing and other machine learning tasks. The vulnerability, tracked as ZDI-26-942, was reported by Mat Powell of TrendAI Zero Day Initiative and carries a CVSS score of 7.8, indicating a high severity.
The flaw resides within the rerank.py script of the fairseq library. According to the advisory, the vulnerability stems from a lack of proper validation of user-supplied input before it is used in executing Python code. This oversight allows a remote attacker to inject and execute arbitrary Python code within the context of the affected application or process.
Exploitation of this vulnerability requires user interaction. Attackers can trick a victim into visiting a malicious webpage or opening a specially crafted file that leverages the flaw in the fairseq library. Once triggered, the attacker can achieve arbitrary code execution on the vulnerable system, potentially leading to a full compromise.
The disclosure timeline reveals that ZDI initially reported the vulnerability to Meta on March 26, 2026. Meta acknowledged the report, but by September 17, 2026, the company communicated that the fairseq repository was no longer actively maintained and had been archived. Following this, ZDI proceeded with the public disclosure on November 11, 2026, classifying it as a zero-day advisory due to the lack of an active maintenance or patching effort from Meta.
Given that the fairseq repository has been archived and is no longer maintained by Meta, there is no official patch or security update available for this vulnerability. The only recommended mitigation strategy advised by ZDI is to restrict any interaction with the product or systems that utilize the affected versions of the fairseq library. This means organizations should avoid processing untrusted input or running code from unknown sources that might depend on this library.
The archiving of the fairseq repository by Meta raises concerns about the security posture of projects that rely on it. While fairseq is a powerful tool, its unmaintained status means that any vulnerabilities discovered, such as ZDI-26-942, will likely remain unaddressed, posing a persistent risk to users. This situation underscores the importance of ongoing maintenance and security support for widely used software libraries, especially those developed by major technology companies.
This vulnerability highlights a common challenge in the open-source ecosystem: the lifecycle of software projects. When projects are archived, they can become security liabilities if not properly sunsetted or migrated. Users of such projects must be vigilant in assessing their dependencies and considering alternatives or implementing robust compensating controls to mitigate the risks associated with unmaintained software.
This advisory from Zero Day Initiative (ZDI) provides further details on the previously disclosed remote code execution vulnerability in Meta's fairseq library. The vulnerability, tracked as ZDI-26-941, stems from improper validation of user-supplied strings during configuration file parsing, allowing attackers to execute arbitrary Python code in the context of the current process. Notably, the fairseq repository has been archived and is no longer maintained by Meta, with ZDI publishing this as a 0-day advisory due to the lack of a vendor patch.
This advisory provides further details on the Meta fairseq parse_manifest code injection vulnerability, including its CVSS score of 7.8 and the specific method parse_manifest as the point of exploitation. It also details the disclosure timeline, noting that Meta acknowledged the report but indicated the fairseq repository is no longer maintained and has been archived, leading ZDI to publish it as a 0-day advisory.
This advisory, ZDI-26-936, details a remote code execution vulnerability in Meta's fairseq library stemming from improper YAML file parsing. While the original advisory indicates the fairseq repository is no longer maintained and has been archived, the Zero Day Initiative has published details of this flaw, assigning it a CVSS score of 7.8. Exploitation requires user interaction, where a target must open a malicious file to trigger arbitrary code execution within the context of the current process.
This advisory from Zero Day Initiative (ZDI) provides further details on the remote code execution vulnerability (ZDI-26-935) affecting Meta's fairseq library. The vulnerability stems from improper validation of user-supplied strings during YAML file parsing, allowing attackers to execute arbitrary code in the context of the current process. Notably, the fairseq repository has been archived and is no longer maintained by Meta, rendering patching infeasible and making mitigation efforts focused on restricting interaction with the product.
This advisory from Zero Day Initiative (ZDI) details a remote code execution vulnerability (ZDI-26-934) in Meta's fairseq library, stemming from improper validation during YAML file parsing. The vendor has acknowledged the report but indicated that the fairseq repository is no longer maintained and has been archived, effectively leaving the vulnerability unpatched.
This advisory from Zero Day Initiative (ZDI) provides further details on the remote code execution vulnerability affecting Meta's fairseq library. The vulnerability, tracked as ZDI-26-933, stems from improper validation of user-supplied strings during YAML file parsing, leading to arbitrary code execution in the context of the current process. Notably, the fairseq repository has been archived and is no longer maintained by Meta, meaning a patch is unlikely to be released.
This advisory from Zero Day Initiative (ZDI) provides further details on the previously disclosed critical remote code execution vulnerability in Meta's fairseq library. The vulnerability, identified as ZDI-26-930, stems from improper YAML file parsing, allowing an attacker to achieve arbitrary code execution on vulnerable systems. Exploitation requires the victim to open a specially crafted malicious file, and the vulnerability carries a CVSS score of 7.8. Notably, the fairseq repository is no longer maintained by Meta and has been archived, meaning a patch is unlikely to be released.
The Zero Day Initiative (ZDI) has published advisory ZDI-26-929 detailing a critical remote code execution vulnerability in Meta's fairseq library. This advisory highlights that the fairseq repository is no longer maintained and has been archived by Meta, meaning no official patches will be released. The vulnerability, stemming from improper YAML file parsing, allows attackers to execute arbitrary code in the context of the current process, with exploitation requiring the target user to open a malicious file.
This advisory from Zero Day Initiative (ZDI) provides further technical details on the remote code execution vulnerability affecting Meta's fairseq library. The vulnerability stems from improper validation of user-supplied strings during YAML file parsing, allowing attackers to execute arbitrary Python code in the context of the current process. Notably, the advisory indicates that the fairseq repository has been archived and is no longer maintained by Meta, meaning a patch is unlikely to be released.
The Zero Day Initiative advisory (ZDI-26-924) provides further technical details on the vulnerability, highlighting that it stems from improper validation of user-supplied strings before they are used to execute Python code within the S2TWavTransformerEncoder component. While the vulnerability allows for remote code execution, it requires user interaction, specifically the opening of a malicious file. The advisory also notes that Meta has archived the fairseq repository, indicating it is no longer actively maintained, and thus no patch is expected.
The Zero Day Initiative (ZDI) advisory ZDI-26-923 provides further technical details on the vulnerability, noting it stems from improper validation of a user-supplied string before its use in executing Python code. While the fairseq repository has been archived and is no longer maintained by Meta, ZDI is publishing this as a 0-day advisory due to the continued risk posed by unpatched installations.
The Zero Day Initiative (ZDI) has published advisory ZDI-26-922 detailing a remote code execution vulnerability in Meta's fairseq library. This advisory highlights that the fairseq repository is no longer maintained by Meta and has been archived, meaning no official patch will be released. ZDI reported the vulnerability to Meta on March 26, 2026, and after a period of no updates, proceeded with a public disclosure on November 11, 2026, classifying it as a 0-day advisory due to the lack of maintenance.
This advisory from Zero Day Initiative (ZDI-26-920) details a remote code execution vulnerability in Meta's fairseq library, specifically within the Data2VecAudioModel component. The vulnerability arises from improper validation of user-supplied strings during YAML file parsing, allowing attackers to execute arbitrary Python code in the context of the current process. While user interaction is required, typically by opening a malicious file, the vendor has indicated that the fairseq repository is no longer maintained and has been archived, leaving affected installations without a patch.
This advisory from Zero Day Initiative (ZDI) details a remote code execution vulnerability in Meta's fairseq library, specifically within the VGGTransformerModel's YAML file parsing. The vulnerability, assigned a CVSS score of 7.8, requires user interaction via a malicious file and allows attackers to execute arbitrary code in the context of the current process. Notably, Meta has indicated that the fairseq repository is no longer maintained and has been archived, meaning a patch is unlikely.
The Zero Day Initiative (ZDI) has published details on ZDI-26-917, a remote code execution vulnerability in Meta's fairseq library. This advisory reveals that the vulnerability stems from improper handling of the load_speaker function, allowing attackers to execute arbitrary code in the context of the current process. Notably, the fairseq repository has been archived and is no longer maintained by Meta, meaning a patch is unlikely and users are advised to restrict interaction with the product.
This advisory updates the initial report by detailing the vendor's response and the current status of the vulnerability. Meta has indicated that the fairseq repository has been archived and is no longer maintained, effectively meaning no patch will be released. Zero Day Initiative intends to publish the details as a 0-day advisory due to the lack of a fix.
This advisory from Zero Day Initiative (ZDI) reveals that Meta's fairseq library is affected by a remote code execution vulnerability, ZDI-26-915. The vulnerability stems from improper validation of user-supplied strings within the FilterNamesDataset class, allowing attackers to execute arbitrary Python code in the context of the current process. Notably, the fairseq repository has been archived and is no longer maintained by Meta, meaning a patch is unlikely.
The Zero Day Initiative (ZDI) has published details on this vulnerability, assigning it the identifier ZDI-26-919. The advisory notes that Meta's fairseq repository has been archived and is no longer maintained, meaning a patch is unlikely to be released. ZDI reported the vulnerability to Meta on March 26, 2026, and after receiving no updates regarding a fix, has proceeded with a public disclosure.
The vulnerability, ZDI-26-913, specifically resides within the load_audio_path method of Meta's fairseq library. Attackers can exploit this flaw by tricking users into interacting with a malicious file or webpage, leading to arbitrary code execution in the context of the current process. Notably, Meta has indicated that the fairseq repository is no longer maintained and has been archived, leaving affected installations without official patches.
The vulnerability, tracked as ZDI-26-932, stems from improper YAML file parsing within the CtcCriterion component of Meta's fairseq library. While the original disclosure did not specify the exact mechanism, this new advisory clarifies that the flaw lies in the lack of proper validation of user-supplied strings before they are used to execute Python code. Exploitation requires a user to open a malicious file, and the vendor has indicated that the fairseq repository is no longer maintained and has been archived, making patching infeasible.
This advisory from Zero Day Initiative (ZDI) provides further details on the previously disclosed critical remote code execution vulnerability affecting Meta's fairseq library. The vulnerability, tracked as ZDI-26-931, stems from improper validation of user-supplied strings during YAML file parsing, allowing attackers to execute arbitrary code in the context of the current process. Notably, the fairseq repository has since been archived and is no longer maintained by Meta, leaving affected users with limited options for remediation beyond restricting interaction with the product.
The Zero Day Initiative (ZDI) advisory ZDI-26-928 details a critical remote code execution vulnerability in Meta's fairseq library, stemming from improper validation during YAML file parsing. While the original disclosure did not specify the exact vulnerability type, this new information clarifies it as a code injection flaw due to unsafe handling of user-supplied strings within the configuration parsing process. The vendor has indicated that the fairseq repository is no longer maintained and has been archived, leaving users without a direct patch.
This advisory from Zero Day Initiative (ZDI) details a critical remote code execution vulnerability, ZDI-26-926, affecting Meta's fairseq library. The flaw stems from improper validation during YAML file parsing within the RawAudioDataset component, allowing attackers to execute arbitrary code by tricking a user into opening a malicious file. ZDI assigned a CVSS score of 7.8 to this vulnerability, and notes that the fairseq repository has been archived and is no longer maintained by Meta, making patching infeasible.
This advisory from Zero Day Initiative (ZDI) provides further details on the Meta fairseq library vulnerability, specifically highlighting that the fairseq repository has been archived and is no longer maintained by Meta. ZDI reported the vulnerability in March 2026, but due to the project's archived status, a patch is unlikely, and the advisory is being published as a 0-day. The vulnerability allows for remote code execution through improper YAML file parsing in the Wav2VecModel component, requiring user interaction to exploit.
The Zero Day Initiative (ZDI) has published details on a critical remote code execution vulnerability, ZDI-26-925, affecting Meta's fairseq library. The vulnerability stems from improper validation of user-supplied strings during configuration file parsing, allowing attackers to execute Python code in the context of the current process. While ZDI reported the issue to Meta on March 26, 2026, the vendor acknowledged that the fairseq repository is no longer maintained and has been archived, leading ZDI to publish the advisory as a 0-day.