CVE-2026-49121: AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization
AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shmbroadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remotesubscribeaddr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable ZMQ socket authentication (e.g., CURVE or HMAC where supported) and enforce message format validation on SUB sockets before any deserialization to prevent unauthenticated inputs from being processed.
ZMQ SUB socket / MessageQueue.recv authentication/HMAC/format_validation = enabled - Configuration
Do not deserialize untrusted pickle payloads. Disable automatic pickle deserialization where possible; if pickle must be used, perform strict validation/sanitization of payloads or move to a safer serialization format before deserializing.
MessageQueue.recv (pickle deserialization) pickle_deserialization = disabled or strictly validated - Configuration
Validate and authorize any supplied Handle and its remote_subscribe_addr prior to use. Reject forged or untrusted Handle values and ensure remote_subscribe_addr originates from trusted/known sources.
Handle / remote_subscribe_addr remote_subscribe_addr_validation = required/authorized-only - Compensating control
Restrict access to the writer XPUB endpoint with network controls (firewall, ACLs, segmentation) so only trusted cluster nodes or management hosts can reach it; isolate the XPUB endpoint from untrusted networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49121?
The severity of CVE-2026-49121 is critical, with a score of 9.2.
What vulnerability type is described in CVE-2026-49121?
CVE-2026-49121 is an unauthenticated remote code execution vulnerability.
What component is affected by CVE-2026-49121?
CVE-2026-49121 affects the AI Tensor Engine for ROCm (AITER) version 0.1.14.
How do I fix CVE-2026-49121?
To fix CVE-2026-49121, upgrade to a version of AITER that has mitigated this vulnerability.
What exploit method is used in CVE-2026-49121?
CVE-2026-49121 allows attackers to exploit the vulnerability by sending a malicious pickle payload through the MessageQueue.recv() function.