ZDI-26-912: (0Day) Meta Detectron2 detection_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
Summary: ZDI published a 0-day advisory for a deserialization flaw in Meta Detectron2's parsing of checkpoint files, where missing validation of user-supplied data lets remote attackers execute arbitrary code in the context of the current process. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file; ZDI reported the issue on 03/04/26, the vendor called it a duplicate on 03/06/26, and ZDI notified the vendor on 10/23/26 of its intent to publish.
What you should know: The vendor classified the report as a duplicate and no fix is described here, so the only mitigation ZDI names is restricting interaction with the product - meaning any team loading Detectron2 checkpoints from outside its own pipeline is exposed until a patch exists.
Read the original at Zero Day Initiative ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026