CVE-2025-47277 affects Red Hat AI Inference Server 3.0 (vLLM) and involves a deserialization flaw in the PyNcclPipe KV cache transfer interface used with the V0 engine. This flaw allows an attacker with network access to the TCPStore interface to perform unauthorized access to key-value caches and potentially achieve remote code execution by exploiting unsafe deserialization (CWE-502). The vulnerability is mitigated by default network isolation of vLLM nodes, and the vulnerable interface is not intended for exposure outside secured internal clusters. Exploitation requires a misconfiguration that exposes the TCPStore service to untrusted networks. Red Hat classifies this vulnerability as moderate due to limited exploitability and impact scope. No patch or mitigation meeting Red Hat's standards is currently available, and users are advised to maintain proper network segmentation and follow documented deployment guidelines.

The vulnerability could allow an attacker with direct network access to a misconfigured or publicly exposed TCPStore interface to execute arbitrary code remotely via unsafe deserialization. This impacts confidentiality, integrity, and availability of the affected system. However, the risk is constrained by the requirement for specific deployment conditions: the use of the V0 engine with PyNcclPipe, and exposure of the TCPStore service outside isolated internal networks. Under default configurations, the vulnerability is not exploitable. There are no known exploits in the wild. The overall impact is rated moderate by Red Hat.

Red Hat currently does not provide a patch or mitigation that meets their standards for usability and stability. The vulnerability is mitigated by default network isolation of vLLM nodes, and the TCPStore interface should not be exposed to untrusted networks. Users should ensure that vLLM deployments follow the official documentation to restrict network exposure and avoid binding the TCPStore service to public interfaces. Monitoring and maintaining proper network segmentation is recommended until an official fix is released.