CVE-2026-49121: AI Tensor Engine for ROCm (AITER) Unauthenticated RCE via Pickle Deserialization
AITER (AI Tensor Engine for ROCm) through 0.1.14 deserializes pickle data received in MessageQueue.recv() without authentication, HMAC or format validation, which the record links to unauthenticated remote code execution. NVD rates it critical with a base score of 9.8, and the record notes that reachable remote reader workers may be affected. CISA KEV does not list it, and the sources consulted do not confirm exploitation in the wild.
Overview
AITER (AI Tensor Engine for ROCm) through 0.1.14 contains an unauthenticated remote code execution flaw classified as CWE-502, deserialization of untrusted data. The issue is in MessageQueue.recv() in shm_broadcast.py, where received messages are deserialized with pickle without authentication, HMAC or format validation.
Impact
- The NVD base score of 9.8 rates confidentiality, integrity and availability impacts as high, with no privileges or user interaction required.
- According to the record, code can run as the inference worker process on every remote reader worker, so a successful attack could affect all reachable readers at once.
- The record does not describe the concrete data at risk; any consequences beyond code execution in the worker process are an inference.
Affected products and versions
- AMD Aiter and ROCm Aiter are listed in the record with versions through 0.1.14 (recorded as less than or equal to 0.1.14).
- The record states no fixed version number. Consult the patch reference at GitHub pull request 3170 to determine the remediated code.
Exploitation status
- CISA KEV does not list this CVE, so the record does not establish active exploitation.
- No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability is 0.01514 with a percentile of 0.74318, and SSVC lists exploitation as proof-of-concept and automatable as no.
Remediation and mitigation
- Review the patch reference pull request 3170 and upgrade to a build that includes it, after validating the fixed version in the vendor or project advisory.
- Review the mitigation discussion in issue 3076 for interim measures.
- Restrict network reachability of the writer XPUB endpoint and the ZMQ channels to trusted hosts only.
- Do not deserialize pickle data from untrusted sources; prefer formats that do not execute code on load.
Detection guidance
- Inventory hosts running AITER and identify those at or below the affected range.
- Monitor for unexpected inbound connections to the message broadcast ports and for unexpected child processes or outbound connections from inference worker processes.
- Audit configuration of remote subscribe addresses used in cluster handles.
Limitations of the available information
- The record gives no fixed version string and no proof-of-concept details in the content provided.
- The exact deployment conditions, such as whether the cluster network is exposed, are unknown.
- The 8.1 and 9.2 scores from other providers are not reconciled with the NVD score in the record.
Frequently asked questions
What is the core weakness in CVE-2026-49121?
The record classifies it as CWE-502, deserialization of untrusted data, in MessageQueue.recv() where pickle data is processed without authentication or validation.
Is this vulnerability known to be exploited in the wild?
No. CISA KEV does not list it, and the sources consulted do not confirm active exploitation.
Which versions are affected?
The record lists AMD Aiter and ROCm Aiter with versions through 0.1.14. It does not state a fixed version number.
What should defenders do now?
Review the patch pull request, upgrade to a build that includes it, restrict network access to the message channels, and avoid deserializing untrusted pickle data.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.