ZDI-26-911: (0Day) Meta Detectron2 Dense Pose Deserialization of Untrusted Data Remote Code Execution Vulnerability
Summary: The Zero Day Initiative published a 0-day advisory for a remote code execution flaw in Meta Detectron2, where parsing of pickle checkpoint files lacks proper validation of user-supplied data and allows deserialization of untrusted data. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and lets an attacker execute code in the context of the current process.
Bottom line: ZDI reported the flaw to the vendor on 03/26/26, asked for updates on 07/27/26, and notified the vendor of its intent to publish as a 0-day on 10/23/26 - and its stated mitigation is only to restrict interaction with the product, leaving no patch in the advisory.
Read the original at Zero Day Initiative ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026