This vulnerability affects the FedML-AI FedML software up to version 0.8.9. The issue lies in the sendMessage function of grpc_server.py in the gRPC server component, where manipulated input can lead to unsafe deserialization. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No vendor advisory or patch information is available, and the vendor has not responded to disclosure attempts.

Successful exploitation of this vulnerability could allow an attacker to perform unsafe deserialization remotely, potentially leading to arbitrary code execution or other impacts related to deserialization flaws. The CVSS vector indicates low confidentiality, integrity, and availability impacts, but the exact consequences depend on the deserialization context. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should consider restricting network access to the vulnerable gRPC server component and monitor for unusual activity as a precaution until an official fix is released.