ZDI-26-910: (0Day) Meta Detectron2 Lazy Config Deserialization of Untrusted Data Remote Code Execution Vulnerability
Summary: The Zero Day Initiative published a 0-day advisory for a remote code execution flaw in Meta Detectron2, where handling of YAML files lacks proper validation of user-supplied data and allows deserialization of untrusted data. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and lets an attacker execute code in the context of the current process.
Key Takeaway: ZDI reported the flaw to the vendor on 03/26/26, asked for updates on 07/27/26, and notified the vendor on 10/23/26 of its intent to publish as a 0-day, leaving users with no vendor fix and only the mitigation of restricting interaction with the product.
Read the original at Zero Day Initiative ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026