Zero Day Initiative Discloses Critical Deserialization Vulnerability in Genesis World
A critical deserialization vulnerability in Genesis World, ZDI-26-756, allows remote attackers to execute arbitrary code on vulnerable installations, with a CVSS score of 7.8.
The Zero Day Initiative (ZDI) has publicly disclosed ZDI-26-756, a critical remote code execution vulnerability affecting Genesis World. This flaw stems from an insecure deserialization process when handling checkpoint files, allowing attackers to execute arbitrary code within the context of the affected process.
The vulnerability arises from a failure to properly validate user-supplied data during the deserialization of checkpoint files. This oversight enables an attacker to inject malicious data that, when processed, leads to the execution of arbitrary code. While exploitation requires interaction with the Genesis World product, the specific attack vectors can vary depending on how the software is implemented and used.
The CVSS score for this vulnerability is rated at 7.8, indicating a high severity. Successful exploitation could lead to a complete compromise of the affected Genesis World installation, allowing attackers to control the system, steal data, or deploy further malicious payloads. The need for interaction means that users must be tricked into performing a specific action, such as loading a malicious checkpoint file.
ZDI's disclosure timeline highlights a challenging engagement with the vendor. Initial contact was made on July 16, 2026, with ZDI attempting to establish a secure channel for disclosures. Despite follow-up attempts, including a request to update the vendor's security policy and a query for PSIRT contacts, the vendor's response was limited, leading ZDI to notify them of their intention to publish the advisory as a 0-day on September 11, 2026.
Ultimately, the vulnerability was reported to the vendor on September 25, 2026, with a coordinated public release of the advisory on October 13, 2026. The advisory was also updated on the same day. The vulnerability was discovered by Aaron Luo of VicOne LAB R7.
Given the nature of the deserialization flaw, the primary mitigation strategy recommended by ZDI is to restrict interaction with the product. This means limiting who can upload or process checkpoint files and ensuring that only trusted sources are used. Without a vendor-provided patch, strict access controls and input validation are crucial for defense.
This disclosure adds to a series of recent security advisories concerning Genesis World, following reports of a Server-Side Request Forgery (SSRF) vulnerability (ZDI-26-755) and a Directory Traversal vulnerability (ZDI-26-754). The repeated discovery of critical flaws underscores the need for enhanced security practices and diligent patching by the Genesis World development team.
Users of Genesis World are strongly advised to review the ZDI advisory and implement the recommended mitigation strategies to protect their installations from potential exploitation. The lack of a vendor patch at the time of disclosure emphasizes the urgency of restricting access and monitoring for any suspicious activity related to checkpoint file processing.