CVE-2025-66455: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.7%, percentile 52: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 52% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes lmdeploy (PyPI) >= 0.9.2, < 0.16.0, fixed in 0.16.0. Check your lockfile, including transitive dependencies.

What it is

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj() to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj() using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the POST /distserve/p2pconnect HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching /distserve/ endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe.

From the GitHub advisory

Summary

LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj() to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj() using Python pickle deserialization, which can execute arbitrary code while reconstructing an object.

The peer address used by the receiver was supplied through the POST /distserve/p2pconnect HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload.

API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process.

This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow.

Weakness type: CWE-502.

Product: lmdeploy (PyPI) · Assigned by: GitHub_M · Published: 2026-09-18

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.69% probability of exploitation activity in the next 30 days; percentile 52.

Timeline

• 2026-09-18 — CVE record last updated
• 2026-09-18 — CVE record published by GitHub_M
• 2026-09-18 — GitHub-reviewed advisory GHSA-2vh9-42vm-xmv2 published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-2vh9-42vm-xmv2 github.com
2. CVE.org record CVE-2025-66455 cve.org
3. NVD entry CVE-2025-66455 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest