Which versions of AMD AITER are affected by CVE-2026-49121?

CVE-2026-49121 affects AMD's AI Tensor Engine for ROCm (AITER) through version 0.1.14, enabling unauthenticated remote code execution across all inference workers in a distributed cluster.. A patch is available.

How to fix or mitigate CVE-2026-49121?

Within 24 hours: Identify all systems running AITER through version 0.1.14 and confirm exposure of ZMQ SUB sockets to untrusted networks. Within 7 days: Apply AMD vendor-released patch; coordinate cluster maintenance windows immediately if downtime is required. Within 30 days: Verify patch deployment across all inference workers and establish monitoring of pickle deserialization activity on ZMQ endpoints.

AMD AITER CVE-2026-49121

Q: What is the CVSS score of CVE-2026-49121?

CVE-2026-49121 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-33717 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-01 VulnCheck

GHSA-3qph-h85w-86qp

RCE Deserialization Aiter

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 19:22 vuln.today

Analysis Generated

Jun 01, 2026 - 19:22 vuln.today

Severity Changed

Jun 01, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

Jun 01, 2026 - 19:22 NVD

8.1 (HIGH) 9.2 (CRITICAL)

DescriptionCVE.org

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_addr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.

AnalysisAI

Remote code execution in AMD's AI Tensor Engine for ROCm (AITER) through version 0.1.14 allows unauthenticated network attackers to run arbitrary code on every inference worker in a distributed cluster by sending a malicious pickle payload to the ZMQ SUB socket consumed by MessageQueue.recv() in shm_broadcast.py. The vulnerability stems from unauthenticated, unvalidated pickle deserialization with no HMAC or format checks; no public exploit identified at time of analysis, but VulnCheck has published an advisory and AMD has merged an upstream fix.

Technical ContextAI

AITER is AMD's open-source kernel and primitive library for inference and training on Instinct (MI300X/MI308/MI325X/MI355X) and Radeon RDNA4/RDNA5 GPUs, consumed downstream by vLLM, SGLang, ATOM, and PyTorch ROCm. The flawed component, shm_broadcast.py, implements an inter-worker message bus using ZeroMQ's XPUB/SUB pattern to broadcast tensors and control messages across distributed inference workers, and the MessageQueue.recv() method calls Python's pickle.loads (or equivalent) on whatever bytes arrive on the SUB socket. This is a textbook CWE-502 Deserialization of Untrusted Data: pickle is Turing-complete by design (objects can define __reduce__ to execute arbitrary callables on load), so any party that can write to the ZMQ topic - either by reaching the writer's XPUB endpoint on the cluster fabric, or by tricking a worker into connecting to a Handle whose remote_subscribe_addr is attacker-controlled - gains code execution in the worker context.

RemediationAI

Upstream fix available (GitHub PR ROCm/aiter#3170 referenced from issue #3076); a released patched version is not independently confirmed from the provided data - verify against the AITER release notes at https://github.com/ROCm/aiter/releases and pin to the first post-fix tag once published, then rebuild or reinstall any downstream vLLM/SGLang/ATOM/PyTorch-ROCm images that bundle AITER. Until a tagged release is deployed, compensating controls are: restrict the ZMQ XPUB/SUB ports to the dedicated cluster interconnect via host firewall or network policy so only legitimate worker nodes can connect (side effect: breaks any cross-cluster or debugging tooling that subscribed remotely); refuse to accept Handle objects whose remote_subscribe_addr is not on an allowlisted internal subnet (requires a small wrapper around the MessageQueue constructor); and run inference workers under a dedicated unprivileged UID with seccomp/AppArmor profiles that block exec and outbound network egress to limit blast radius if a worker is compromised. Do not expose AITER worker endpoints to shared or tenant-accessible networks under any circumstances until patched.