---
title: "CVE-2025-66455: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py"
url: https://erroneo.us/security/cve/CVE-2025-66455/
description: "CVE-2025-66455 (lmdeploy (PyPI)): LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-18
date_modified: 2026-09-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-66455"
kev: false
cvss: 9.8
epss: 0.00693
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-66455: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.7% , percentile 52: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 52% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes lmdeploy (PyPI) >= 0.9.2, < 0.16.0, fixed in 0.16.0 . Check your lockfile, including transitive dependencies.

## What it is

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj() to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj() using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the POST /distserve/p2pconnect HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching /distserve/ endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe.

## Affected packages

- PyPI `lmdeploy` >= 0.9.2, < 0.16.0 → fixed: 0.16.0

## Affected products (CVE record)

- InternLM lmdeploy: >= 0.9.2, < 0.16.0

## Severity

- GitHub_M CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.69% probability of exploitation activity in the next 30 days; percentile 52.

## Sources

- [GitHub Advisory GHSA-2vh9-42vm-xmv2](https://github.com/advisories/GHSA-2vh9-42vm-xmv2)
- [CVE.org record CVE-2025-66455](https://www.cve.org/CVERecord?id=CVE-2025-66455)
- [NVD entry CVE-2025-66455](https://nvd.nist.gov/vuln/detail/CVE-2025-66455)
- [github.com](https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2)
- [github.com](https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2)
- [github.com](https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0)

---
Source page: https://erroneo.us/security/cve/CVE-2025-66455/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt