Microsoft Qlib Vulnerability Allows Remote Code Execution via Deserialization Flaw
A deserialization vulnerability in Microsoft Qlib's RestrictedUnpickler component allows remote attackers to execute arbitrary code with user interaction, carrying a CVSS score of 7.8.
The Zero Day Initiative (ZDI) has disclosed a critical deserialization vulnerability affecting Microsoft's Qlib library, identified as ZDI-26-849. This flaw, rated with a CVSS score of 7.8, allows remote attackers to execute arbitrary code on vulnerable systems.
The vulnerability stems from improper validation of user-supplied data within the RestrictedUnpickler component when handling pickle data files. Specifically, the library fails to adequately sanitize input, leading to the deserialization of untrusted data. This can be exploited by an attacker to achieve code execution within the context of the currently logged-in user.
Exploitation of this vulnerability requires user interaction. Attackers can trick victims into visiting a malicious web page or opening a specially crafted file. Once the user interacts with the malicious content, the deserialization flaw is triggered, allowing the attacker to run their code on the compromised system.
Microsoft has addressed this vulnerability by releasing version 0.9.8 of the Qlib library. Users are strongly advised to update to this patched version to mitigate the risk of exploitation. The fix was integrated into the library's release, indicating a proactive approach by the development team to secure their software.
The disclosure timeline shows that the vulnerability was initially reported to the vendor on July 17, 2026. Following a coordinated disclosure process, the advisory was publicly released on November 2, 2026, with an update to the advisory also published on the same day. This timeline adheres to standard industry practices for responsible vulnerability disclosure.
The discovery and reporting of this vulnerability are credited to YJK, a researcher from ZUSO ART. Their work highlights the ongoing importance of independent security research in identifying and addressing potential threats before they can be widely exploited.
This vulnerability is a prime example of how insecure deserialization can lead to severe security consequences. Libraries that process serialized data, especially from untrusted sources, must implement robust validation mechanisms to prevent attackers from injecting malicious objects or commands. The widespread use of such libraries in machine learning and data processing frameworks makes this a significant concern for the ecosystem.
As with many such vulnerabilities, the potential impact is significant, particularly in environments where Qlib might be used for processing data from external or less trusted sources. The ability to execute arbitrary code on a user's machine opens the door to further system compromise, data theft, or the deployment of malicious software.
This advisory updates the initial report by providing specific details on the vulnerability within the MLflowRecorder class. It highlights that the flaw stems from improper validation of user-supplied data, leading to deserialization of untrusted data. The vulnerability has been fixed in version 0.9.8 of Microsoft Qlib.
This advisory updates the initial report by providing a link to the specific release notes for version 0.9.8, which contains the fix for this vulnerability. The vulnerability was reported to the vendor on July 22, 2026, and the coordinated public release of the advisory occurred on November 2, 2026, with an update to the advisory on the same day.