What’s Vulnerable › Products

InternLM lmdeploy vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your InternLM lmdeploy version is affected

Latest InternLM lmdeploy vulnerabilities

• CVE-2026-33625 — LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading (CVSS 8.8)
• CVE-2025-66455 — LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py (CVSS 9.8)
• CVE-2026-92983 — InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch (CVSS 7.5)
• CVE-2026-92971 — InternLM LMDeploy through 0.17.0 Assertion Denial of Service (CVSS 7.5)
• CVE-2025-59953 — LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy (CVSS 9.8)
• CVE-2026-76850 — LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector (CVSS 9.8)
• CVE-2026-63764 — LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass (CVSS 8.6)
• CVE-2026-46517 — LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out (CVSS 7.8)
• CVE-2026-46432 — LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization (CVSS 7.8)
• CVE-2026-33626 — LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading (CVSS 7.5)
• CVE-2025-67729 — lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() (CVSS 8.8)
• CVE-2025-3163 — InternLM LMDeploy conf.py open code injection (CVSS 7.8)
• CVE-2025-3162 — InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization (CVSS 7.8)