CVE-2025-66455 is a deserialization of untrusted data vulnerability (CWE-502) in InternLM's LMDeploy toolkit affecting versions >=0.9.2 and <0.16.0. The PyTorch DistServe/PD-disaggregation control plane uses recv_pyobj() from PyZMQ to deserialize messages via Python pickle, which can execute arbitrary code during object reconstruction. The vulnerable code accepts a peer address from the HTTP endpoint POST /distserve/p2p_connect, allowing an attacker who can reach the DistServe API server to force it to connect to a malicious ZeroMQ endpoint and deserialize a crafted pickle payload. Without API-key authentication enabled (which is off by default), this leads to unauthenticated remote code execution with the LMDeploy serving process privileges. The vulnerability only affects deployments using the disaggregated serving path and not ordinary LMDeploy deployments. The issue was fixed in LMDeploy 0.16.0.

Successful exploitation allows unauthenticated remote code execution on the LMDeploy server process, leading to full compromise of the affected service. This can result in complete loss of confidentiality, integrity, and availability of the LMDeploy instance. The vulnerability is critical with a CVSS 3.1 score of 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fixed version, LMDeploy 0.16.0, is available and should be applied to remediate this vulnerability. For users unable to upgrade immediately, mitigation includes restricting access to the /distserve/* HTTP endpoints to trusted clients only, enabling API-key authentication on the DistServe API, limiting the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, and blocking arbitrary outbound ZeroMQ connections from serving nodes. These mitigations reduce exposure but do not eliminate the risk posed by unsafe pickle deserialization.