Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 LMDeploy, Pickle Deserialization Remote Code Execution, #CVE-2025-59953 (Critical) -DC-Sep2026-2408 https://dailycve.com/lmdeploy-pickle-deserialization-remote-code-execution-cve-2025-59953-critical-dc-sep2026-2408/
Post summary
The post discloses CVE-2025-59953, a critical pickle deserialization remote code execution vulnerability in LMDeploy, and links to a DailyCVE summary page.