CVE-2026-49121

The MessageQueue.recv() function in the shm_broadcast.py file deserializes incoming data through a ZMQ SUB socket without any authentication verification, HMAC signature, or format validation. An attacker who can reach the writer XPUB endpoint on the cluster network or provide a forged Handle object with a controlled remote_subscribe_addr can send a crafted pickle payload. Python's pickle library by design allows arbitrary code execution during the deserialization process, making this vector exceptionally dangerous. The malicious payload is then executed in the context of the inference worker process on each remote node reading the data.

An attacker can remotely execute arbitrary code (RCE) without any authentication, while simultaneously gaining control over all worker nodes in the cluster, which can lead to complete breach of confidentiality, integrity, and availability of processed data and systems.

Patches available from the manufacturer should be applied in accordance with the references (pull request available at https://github.com/ROCm/aiter/pull/3170). Until the fix is implemented, it is recommended to isolate the cluster network and block access to ZMQ XPUB/SUB endpoints from untrusted networks using firewalls or network rules.

AI Tensor Engine for ROCm (AITER) in versions from the beginning up to and including 0.1.14