InternLM lmdeploy's handle_zmq_recv coroutine deserializes peer-to-peer cache-free requests using pickle.loads() before verifying the object's type. The source of the serialized data is a ZeroMQ PULL socket connected to an endpoint specified by the remote engine info, which can be attacker-controlled if the server is not started with API keys (authentication disabled by default). This allows a remote attacker to direct the engine to pull malicious serialized data, resulting in arbitrary code execution. Deployments without disaggregated serving enabled are not affected as the receive loop is not started.

A remote attacker can achieve unauthenticated remote code execution on the engine process by sending crafted serialized data to a ZeroMQ endpoint that the engine connects to. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 4.0 base score of 9.3 (critical), reflecting its network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should enable API key authentication to prevent unauthenticated access to the vulnerable endpoints or disable disaggregated serving to avoid starting the vulnerable receive loop. Restricting network access to trusted endpoints for ZeroMQ connections can also reduce exposure.