CVE-2025-59953criticalCode execution2026-09-16
CVE-2025-59953: LMDeploy's ZeroMQ RPC server unpickles incoming messages, remote code execution in 0.9.1 to 0.10.1
LMDeploy 0.9.1 up to 0.10.2 runs an RPC server (AsyncRPCServer in zmq_rpc.py) whose call_and_response() passes received messages straight to pickle.loads(). The server doesn't check where connections come from, so anyone on the network who finds its port can send a crafted pickle and get code execution. Upgrade to 0.10.2 or later.
What it is
AsyncRPCServer.call_and_response() in zmq_rpc.py deserializes incoming RPC messages with pickle.loads() without any sanitization. A crafted pickle runs arbitrary Python on the host.
The reporter's proof of concept changed the client to point at a remote IP and opened a reverse shell. The port is randomized, but the advisory notes an attacker can scan for it.
Version 0.10.2 contains the patch.
How to check
- Run pip show lmdeploy and see whether the version is 0.9.1 or later but below 0.10.2.
- Check whether hosts running LMDeploy expose high ports to networks you don't trust.
How to fix
- Upgrade to LMDeploy 0.10.2 or later (current releases also include later pickle fixes such as 0.16.0).
- Firewall LMDeploy hosts so only trusted machines can reach their ports.
pip show lmdeploy | grep -i ^version
pip install -U 'lmdeploy>=0.16.0'Sources
More advisories for this tool
- criticalCVE-2026-119706: LMDeploy api_server runs attacker pickles sent to /update_weights, unauthenticated RCE in 0.9.0 to 0.18.0, still unfixed
- criticalCVE-2025-66455: LMDeploy DistServe connects to attacker ZeroMQ peers and unpickles their messages, unauthenticated RCE before 0.16.0
- highCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with url
- highCVE-2026-46432: LMDeploy before 0.13.0 always loads models with trust_remote_code=True, so a malicious model repo runs code