What is the CVSS score of EUVD-2025-210921?

EUVD-2025-210921 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Which versions of InternLM LMDeploy are affected by EUVD-2025-210921?

InternLM's LMDeploy model-serving framework (versions 0.9.1 through 0.10.1) contains a critical remote code execution flaw in its AsyncRPCServer endpoint that can hand an outside party full control…. A patch is available.

Is there a public PoC exploit available for EUVD-2025-210921?

Yes, a public proof-of-concept exploit is available for EUVD-2025-210921. Prioritise patching immediately.

How to fix or mitigate EUVD-2025-210921?

Within 24 hours, inventory every LMDeploy deployment running versions 0.9.1 through 0.10.1, determine for each whether the AsyncRPCServer RPC endpoint is bound to anything other than localhost, and immediately block the associated port at host and network firewalls or security groups; where the service must run, rebind the listener to 127.0.0.1 so it is not reachable from untrusted networks, and pull connection and process logs to check for unexplained scanning or inbound connections to that port. Within 7 days, upgrade all affected instances to LMDeploy 0.10.2, which the advisory text identifies as the release that remediates the pickle deserialization flaw and restricts the RPC service to localhost - verifying current vendor patch availability against the advisory, since no vendor-released patch is confirmed in our tracking - and where upgrading is not yet possible, isolate the affected hosts in a segmented network with no inbound access from general user or internet-facing zones and rotate credentials and tokens present on those hosts, since the pickle.loads() deserialization path and the service's lack of authentication or IP validation make any host reaching the endpoint a full-compromise target. Within 30 days, confirm patch coverage across the full fleet, add RPC endpoint exposure and LMDeploy version checks to asset management and vulnerability scanning, deploy detection content for anomalous pickle/RPC traffic and unexpected listeners on the randomized port, and update the incident response playbook and contact list for an unauthenticated RCE on model-serving infrastructure so the team can act quickly if exploitation is attempted.

InternLM LMDeploy EUVD-2025-210921

| CVE-2025-59953 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-09-16 GitHub_M

GHSA-5h8j-6crg-7rmw

RCE Python Deserialization Lmdeploy

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable RPC deserializing attacker pickle gives direct RCE with full host compromise; randomized port is a discovery hurdle, not CVSS access complexity, so AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 16, 2026 - 19:23 vuln.today

Metadata Corrected

Sep 16, 2026 - 17:40 vuln.today

tag: Python added

Patch available

Sep 16, 2026 - 17:04 EUVD

Analysis Generated

Sep 16, 2026 - 16:47 vuln.today

CVE Published

Sep 16, 2026 - 15:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

Articles & Coverage 1

News Critical RCE in InternLM LMDeploy AsyncRPCServer - CVE-2025-59953 Sep 16, 2026

AnalysisAI

Remote code execution in InternLM LMDeploy versions 0.9.1 through 0.10.1 allows unauthenticated network attackers to run arbitrary commands by sending crafted pickle payloads to the AsyncRPCServer RPC endpoint (zmq_rpc.py). The service deserializes raw messages with pickle.loads() and performs no authentication or IP validation, so any attacker who can reach the randomized port-typically found by scanning-can trigger code execution; publicly available exploit code exists (proof-of-concept with reverse shell demo), and the CVSS 3.1 score is 9.8. This is not confirmed actively exploited (no CISA KEV listing), and exploitation is not possible if the RPC service is bound exclusively to localhost; upgrading to 0.10.2 patches the deserialization flaw and restricts the RPC to localhost.

Technical ContextAI

LMDeploy uses a ZeroMQ-based RPC layer for communication between its components; the AsyncRPCServer class in zmq_rpc.py handles incoming requests in call_and_response(), which calls pickle.loads() directly on the received bytes without any sanitization or class whitelist. This is a textbook CWE-502 deserialization-of-untrusted-data flaw: pickle is not a safe format for untrusted input, and its __reduce__ mechanism allows an attacker to instantiate arbitrary classes and execute commands during deserialization. The affected package is pip/lmdeploy, identified by CPE cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:* (the CPE does not encode version granularity, but the vendor confirms the vulnerable range is >=0.9.1, <0.10.2). The RPC server lacks authentication and does not validate the source IP, and although the listening port is randomized, an attacker on the network can port-scan to locate it; version 0.10.2 contains the vendor patch, with the release notes specifically citing a change to bind zmqrpc to localhost only (PR #4017).

RemediationAI

Upgrade to LMDeploy 0.10.2 (vendor-released patch) as the primary fix; this version patches the deserialization exposure and binds the zmqrpc server to localhost only (PR #4017), which prevents remote exploitation. If immediate upgrade is not possible, restrict the AsyncRPCServer to localhost or a trusted network segment by configuring the RPC binding and/or blocking its dynamically assigned port with host or network firewall rules-note that the randomized port requires scanning to find, so closing all unnecessary ports reduces exposure. Alternatively, disable the RPC service entirely if it is not required for your deployment; trade-off is loss of distributed inference functionality. Monitor for unexpected port scans or connections to the LMDeploy RPC port. Refer to the vendor advisory (https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw) and release notes (https://github.com/InternLM/lmdeploy/releases/tag/v0.10.2) for details.