Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

LMDeploy RPC server can run attacker code

CVE-2025-59953 · published 26 days ago
Summary

The LMDeploy toolkit versions before 0.10.2 allow a remote program to send specially crafted data that the server automatically turns into executable code. This could let an attacker take control of the machine running the LMDeploy service. Update LMDeploy to version 0.10.2 or later to stop the issue.

What to do
  • Update openmmlab lmdeploy to version 0.10.2.
  • Update lmdeploy to version 0.10.2.
Affected software
Ecosystem VendorProductAffected versions
– internlm lmdeploy >= 0.9.1, < 0.10.2
pip openmmlab lmdeploy >= 0.9.1, < 0.10.2
Fix: upgrade to 0.10.2
pip – lmdeploy >= 0.9.1, < 0.10.2
Fix: upgrade to 0.10.2
Original advisory text
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published16 Sep 2026
Updated11 Oct 2026
First seen16 Sep 2026
Sources
CVE-2025-59953 · NVD
CVE-2025-59953 · MITRE
GHSA-5h8j-6crg-7rmw · GHSA
CVE-2025-59953 · OSV
GHSA-5h8j-6crg-7rmw · OSV
PYSEC-2026-4079 · OSV
Track software like this
Free during beta