CVE-2025-59953: LMDeploy RPC Server RCE Vulnerability

CVE-2025-59953 Overview

CVE-2025-59953 is an insecure deserialization vulnerability in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models. The flaw resides in the AsyncRPCServer class implemented in zmq_rpc.py, which handles RPC communications between components. The server's call_and_response() function passes received messages directly to Python's pickle.loads() without validation or authentication. Attackers who can reach the RPC endpoint can send crafted pickle payloads to achieve remote code execution on the host process. Versions 0.9.1 through 0.10.1 are affected, and version 0.10.2 contains the patch.

Critical Impact
Unauthenticated network attackers can execute arbitrary code on any host running an exposed LMDeploy RPC server, leading to full compromise of model-serving infrastructure.

Affected Products

LMDeploy (InternLM) versions 0.9.1 through 0.10.1
AsyncRPCServer component in zmq_rpc.py
Deployments exposing the ZMQ-based RPC service on reachable network interfaces

Discovery Timeline

2026-09-16 - CVE-2025-59953 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2025-59953

Vulnerability Analysis

LMDeploy exposes an asynchronous RPC server built on ZeroMQ to coordinate distributed model-serving operations. The AsyncRPCServer class in zmq_rpc.py receives serialized messages from clients and dispatches them through the call_and_response() handler. This handler invokes pickle.loads() directly on inbound byte strings before any type check, authentication, or integrity verification takes place.

Python's pickle module reconstructs arbitrary objects and honors __reduce__ methods during deserialization. An attacker who submits a pickle payload containing a __reduce__ gadget can execute arbitrary Python code, shell commands, or import chains inside the server process. The vulnerability maps to [CWE-502: Deserialization of Untrusted Data].

Because LMDeploy typically runs with access to GPU resources, model weights, and inference APIs, successful exploitation exposes proprietary models, inference traffic, and downstream services. The RPC channel offers no built-in authentication, so any client that can open a socket to the listening port becomes a viable attacker.

Root Cause

The root cause is direct use of pickle.loads() on network-sourced data without a message authentication code, allowlist, or safer serialization format. Python documentation explicitly warns that unpickling untrusted input is unsafe. The call_and_response() implementation trusted transport-layer separation rather than validating message contents.

Attack Vector

Exploitation requires only network reachability to the LMDeploy RPC port. An attacker crafts a malicious pickle stream whose __reduce__ method invokes os.system, subprocess.Popen, or an equivalent primitive. The attacker then sends the payload over ZeroMQ to the AsyncRPCServer endpoint. When the server calls pickle.loads(), the gadget executes with the privileges of the LMDeploy process. Technical detail is available in the GitHub Security Advisory GHSA-5h8j-6crg-7rmw.

Detection Methods for CVE-2025-59953

Indicators of Compromise

Unexpected child processes spawned by the LMDeploy Python interpreter, such as sh, bash, curl, wget, or python invoking network utilities.
Outbound network connections from LMDeploy hosts to unfamiliar IP addresses or command-and-control infrastructure.
New or modified files under LMDeploy working directories, model cache paths, or user home directories.
ZeroMQ traffic to the RPC port originating from hosts outside the expected inference cluster.

Detection Strategies

Inspect network traffic to the RPC listener for pickle protocol magic bytes (\\x80\\x04 and similar) arriving from untrusted sources.
Monitor Python process telemetry for pickle.loads() call chains that lead to os.system, subprocess, or eval in the LMDeploy service.
Alert on any exec, execve, or fork syscall issued by the LMDeploy worker where the parent context is the RPC handler thread.
Compare the deployed LMDeploy version against 0.10.2 and flag any host still running an affected release.

Monitoring Recommendations

Enable process-lineage logging on hosts running LMDeploy and forward events to a centralized analytics platform.
Track listening ports on inference nodes and alert when the RPC socket becomes reachable from outside the trusted subnet.
Collect authentication and access logs from network segmentation devices protecting the model-serving tier.

How to Mitigate CVE-2025-59953

Immediate Actions Required

Upgrade LMDeploy to version 0.10.2 or later on every host running the RPC server.
Restrict the RPC listener to loopback or a private management interface until the upgrade completes.
Audit firewall rules to ensure only trusted inference workers can reach the ZeroMQ port.
Rotate any credentials, API keys, or model artifacts stored on hosts that exposed a vulnerable RPC server.

Patch Information

The maintainers released the fix in LMDeploy v0.10.2. Administrators should install the patched release using their standard Python package workflow and restart all LMDeploy services. Details on the coordinated fix appear in GHSA-5h8j-6crg-7rmw.

Workarounds

Block external access to the LMDeploy RPC port with host and network firewalls.
Bind the AsyncRPCServer to 127.0.0.1 and tunnel legitimate traffic through an authenticated proxy such as SSH or mutual TLS.
Run LMDeploy under a dedicated low-privilege service account with no write access to model weights or shared storage.
Deploy the service inside a container with a restrictive seccomp profile that blocks execve for the worker process.

bash

# Configuration example
pip install --upgrade "lmdeploy>=0.10.2"

# Restrict RPC exposure to loopback
iptables -A INPUT -p tcp --dport <lmdeploy_rpc_port> ! -s 127.0.0.1 -j DROP