Bug Bounty

ZDI drops 47 Meta AI library zero-days after 230 days unfixed

ZDI has published 47 unpatched code execution flaws in Meta’s fairseq, FAIRChem and Detectron2 libraries after Meta let its disclosure deadline lapse.

Bug motif graphic with the headline 47 Meta AI zero-days go public

The Zero Day Initiative has published 47 unpatched code execution flaws in Meta’s open-source AI research libraries after the vendor let its disclosure deadline lapse. Most had been sitting with Meta since March, and the advisories offer no fix, only advice to limit use of the affected code.

What happened

On 11 November 2026 the Zero Day Initiative (ZDI), the vulnerability purchase and bounty programme operated by TrendAI, released 47 advisories marked “0Day” against Meta software. They run from ZDI-26-907 to ZDI-26-953 and every one carries a CVSS 3.0 score of 7.8. None lists a CVE identifier.

The flaws sit in four libraries that came out of Meta’s AI research group: fairseq, the sequence modelling toolkit, accounts for 31; FAIRChem, used for machine learning in chemistry and materials science, has nine; the Detectron2 computer vision framework has six; and fairseq2 has one. A handful were reported in early March, and the bulk on 26 March, according to the disclosure timelines on the advisories and an analysis by FourWeekMBA, which checked the batch against every advisory page. That puts roughly 230 days between report and publication for most of them.

ZDI’s own notes on each case show how the conversation went. For fairseq, Meta told ZDI in April, and in most cases again in September, that the repository was no longer maintained and had been archived on 20 March 2024. ZDI added a pointed correction: GitHub shows the archive date as 20 March 2026, after the first reports had already landed. One Detectron2 report was waved off as a duplicate of an existing issue on 6 March. On 13 October Meta told ZDI that one FAIRChem flaw had “no security/privacy impact”. ZDI chased for updates on 27 July and, on 23 October, warned Meta it would go public with zero-day advisories.

The contrast inside FAIRChem is striking. ZDI published 17 further FAIRChem advisories on 26 October, also reported in late March, and each of those states that Meta has issued a fix, pointing to a pull request on the project’s GitHub. The nine FAIRChem bugs released this week did not get the same treatment.

The technical picture

Almost all 47 bugs fall into two classes: deserialisation of untrusted data and code injection. The common thread is how the libraries load things researchers routinely download and share, namely model checkpoints, configuration files in YAML, NumPy archives and audio manifests. The FAIRChem flaw in ZDI-26-953, for example, sits in the code that parses inference checkpoints; the fairseq bug in ZDI-26-944 is in a function that loads exponential moving average weights from a checkpoint.

The CVSS vector is local with user interaction required: the victim has to open a malicious file or visit a malicious page. In practice, for a machine learning toolkit, “open a file” means loading a checkpoint or config that someone else produced. Code then runs with the privileges of whatever process loaded it, which on a research workstation or a GPU training node is often a user with broad access to data, credentials and cloud storage. Earlier FAIRChem fixes referenced pickle parsing, the Python serialisation format whose risks are well known in the AI community.

ZDI’s mitigation line is the same on every advisory: restrict interaction with the product. It is the standard wording when no patch exists.

Timeline from Meta receiving the reports in March 2026 to ZDI publishing 47 zero-day advisories on 11 November 2026

Why it matters for UK organisations

These are not obscure tools. FourWeekMBA reports that, according to GitHub figures it pulled on 12 November, the four repositories hold more than 70,000 stars and over 15,000 forks between them, and Detectron2, FAIRChem and fairseq2 are not archived. UK universities, pharmaceutical and materials research groups, and start-ups building speech or vision products are exactly the kind of users who pull these libraries into notebooks, pipelines and containers, often pinned to an old version and forgotten.

The archived fairseq case raises a wider supply chain point. When a vendor archives a repository, the code does not disappear from downstream environments. Forks, internal mirrors and Docker images keep running it. Meta’s reply effectively passes the patching burden to every organisation that still depends on fairseq, whether or not those organisations know it.

For UK firms with a vulnerability disclosure policy of their own, the episode is also a reminder of what researchers and brokers will do when a vendor stops engaging. ZDI has shown it will publish without a patch when the clock runs out.

Expert view

In my experience, disclosure goes wrong less often over technical disagreement than over silence. Here, according to FourWeekMBA’s reading of the timelines, 13 of the 47 cases show no meaningful reply from Meta beyond acknowledging receipt or saying it was investigating. That is the pattern that turns a coordinated disclosure into a zero-day drop.

The archive claim is the part that will draw most attention. Archiving a project is a legitimate decision, but telling a researcher the code was retired two years before it actually was undermines trust in the whole programme. It also leaves the reporter with no fix path, so the only honest move left to ZDI was to warn users.

I would also push back on the “no security impact” response to the FAIRChem report. When we test AI platforms, loading a checkpoint from an untrusted source is one of the most reliable routes to code execution, precisely because data scientists treat model files as data rather than executables. The fact that, according to FourWeekMBA, Meta fixed 17 similar FAIRChem issues within days of the March reports makes the inconsistency harder to explain.

The lesson for defenders: a big company’s name on an open-source project is no guarantee anyone is securing it.

What to do now

  1. Find it. Search code repositories, requirements files, container images and notebooks for fairseq, fairseq2, Detectron2 and FAIRChem. Include forks and internal mirrors.
  2. Treat model files as code. Only load checkpoints, YAML configs and data archives from sources you control or have verified. Record hashes for approved artefacts and block anything else in automated pipelines.
  3. Plan to retire fairseq. With Meta describing it as unmaintained, budget for migration rather than waiting for fixes that are unlikely to arrive.
  4. Contain where it runs. Run training and inference jobs under low-privilege accounts, in containers without standing cloud credentials, and with restricted outbound network access. This maps to the Cyber Essentials controls on secure configuration and user access control.
  5. Patch what can be patched. Keep FAIRChem current so the fixes ZDI recorded in October are in place, and watch the Detectron2 and fairseq2 repositories for updates. Cyber Essentials expects unsupported software to be removed or isolated.
  6. Check your own disclosure handling. If you run a VDP or bug bounty, make sure reports get a substantive response and that any “out of scope” or “no impact” decision is explained in writing.

Bottom line

ZDI’s 47-advisory release is a disclosure failure as much as a vulnerability story. Researchers did their part in March, a broker held the details for months, and the vendor’s answers ranged from silence to a disputed archive date. For UK teams using Meta’s research code, the practical response is to inventory it, stop trusting downloaded model files and move off fairseq.

Sources

Related Posts