CVE-2025-59953: Unauthenticated Remote Code Execution in LMDeploy AsyncRPCServer via Insecure Pickle Deserialization
Vulnerability ID: CVE-2025-59953
CVSS Score: 9.8
Published: 2026-09-16
LMDeploy prior to version 0.10.2 is vulnerable to remote code execution because its AsyncRPCServer component implements unauthenticated, remote-accessible communication sockets and uses the insecure pickle.loads() deserializer to process incoming requests.
TL;DR
Unauthenticated remote attackers can execute arbitrary code on LMDeploy hosts prior to v0.10.2 by sending a malicious Python pickle stream to the dynamically opened ZMQ RPC port.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-502
- Attack Vector: Network
- Complexity: Low
- Privileges Required: None
- EPSS Score: N/A
- Exploit Status: Proof-of-Concept
- CISA KEV Status: Not Listed
Affected Systems
- lmdeploy
-
lmdeploy: >= 0.9.1, < 0.10.2 (Fixed in:
0.10.2)
Mitigation Strategies
- Upgrade LMDeploy to 0.10.2 or higher
- Implement firewall rules to block high random ports
- Use local container network namespaces without host networking
- Run services under a non-root low-privileged user account
Remediation Steps:
- Run pip install --upgrade lmdeploy
- Verify local binding in zmq_rpc.py is localhost
- Establish micro-segmentation rules on model server host nodes
References
- GitHub Security Advisory GHSA-5h8j-6crg-7rmw
- Commit d86046a0e6b02ecaaf7cdb74346d0477130221c2
- LMDeploy v0.10.2 Release
Read the full report for CVE-2025-59953 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)