VulnerabilityModified

CVE-2026-49121

CRITICAL 9.2EPSS 1.10%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_addr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.

CVSS 4.0: 9.2 CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.10% probability · 64th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: amd/aiter
Source: disclosure@vulncheck.com

References

https://github.com/ROCm/aiter/issues/3076Exploit, Issue Tracking, Mitigation
https://github.com/ROCm/aiter/pull/3170Issue Tracking, Patch
https://www.vulncheck.com/advisories/ai-tensor-engine-for-rocm-aiter-unauthenticated-rce-via-messagequeue-recv-pickle-deserializationThird Party Advisory
https://access.redhat.com/security/cve/CVE-2026-49121
https://bugzilla.redhat.com/show_bug.cgi?id=2483882
https://github.com/ROCm/aiter/issues/3076Exploit, Issue Tracking, Mitigation
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49121.json

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.