CVE-2026-49121 is a critical unauthenticated remote code execution vulnerability in ROCm's AI Tensor Engine (AITER) through version 0.1.14. The flaw exists in the MessageQueue.recv() function within shm_broadcast.py, where attackers can send a malicious pickle payload to a ZeroMQ SUB socket that lacks authentication, HMAC, or format validation. By reaching the writer XPUB endpoint or supplying a forged Handle with a controlled remote_subscribe_addr, attackers can execute arbitrary code simultaneously on all remote reader inference worker processes. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and has a CVSS 4.0 score of 9.2, indicating critical severity. No official patch or remediation level is currently stated in the vendor advisory, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on inference worker processes across the cluster network, potentially compromising confidentiality, integrity, and availability of the affected systems. This can lead to full system compromise of the AI inference environment running AITER versions up to 0.1.14.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-49121 for current remediation guidance. Until an official fix is available, restrict network access to the writer XPUB endpoint and ensure that untrusted users cannot send data to the ZMQ SUB socket. Implement network-level controls to prevent unauthorized access to the cluster network components involved. Monitor vendor communications for updates on patches or official mitigations.