CVE-2026-49121

[CVE catalog]

Severity

Critical · CVSS 9.2

Published

Jun 1, 2026, 5:09:18 PM UTC

Source

[NVD] · [CVE record]

EPSS

1.10% · Oct 25, 2026

A flaw was found in AI Tensor Engine for ROCm (AITER). This vulnerability allows unauthenticated remote attackers to execute arbitrary code by sending a specially crafted data package, known as a pickle payload, to a ZeroMQ (ZMQ) subscriber socket. This exploitation is possible due to a lack of authentication, message integrity checks (HMAC), or format validation in the MessageQueue.recv() function. Successful exploitation can lead to arbitrary code execution on every remote reader worker, posing a critical risk to the system's integrity and confidentiality. aiter: AI Tensor Engine for ROCm (AITER): Remote Code Execution via Unauthenticated Pickle Deserialization Red Hat AI Inference Server and Red Hat OpenShift AI ship the AI Tensor Engine for ROCm (AITER) Python package as a dependency in ROCm-based vLLM container images. Affected streams embed AITER versions 0.1.5 through 0.1.10.post2 (published to PyPI under the distribution name amd-aiter, which is the same upstream ROCm/aiter project — its own setup.py sets PACKAGE_NAME = "amd-aiter"), all of which are within the upstream affected range (0.1.14 and earlier). The flaw is an unauthenticated remote code execution vulnerability in AITER MessageQueue.recv() (shm_broadcast.py), where data received on a ZeroMQ subscriber socket is deserialized with Python pickle without authentication or integrity checks (CWE-502). Red Hat rates this issue as Important. Our CVSS score reflects high attack complexity: exploitation requires network access to the inference worker ZMQ XPUB endpoint on the cluster network, or the ability to supply a forged distributed Handle with an attacker-controlled subscribe address. This is not a default remote attack against an unauthenticated internet-facing service. Engineering trackers are filed for affected product streams. Updated container images will be released when a fixed AITER version is available and integrated. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.