CVE-2025-59953

9.8 CRITICALpublic exploit available

Published 2026-09-16 · Updated 2026-09-18

AI risk analysis

Summary: The vulnerability in LMDeploy allows remote code execution due to improper deserialization of messages, posing a critical risk.
Exploitability: Exploitation is relatively straightforward as it requires sending maliciously crafted messages to the RPC server. The server must be running and accessible.
Blast radius: If exploited, this could lead to full compromise of the system hosting the RPC server, including potential data exfiltration and control of the server.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 0.10.2 or later.

rcedeserializationrpccritical

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.