CVE-2026-49121: AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization

Synopsis

This is an unauthenticated remote code execution vulnerability caused by unsafe pickle deserialization in AI Tensor Engine for ROCm (AITER) versions through 0.1.14. The affected function, MessageQueue.recv() in shm_broadcast.py, accepts arbitrary data from a ZMQ SUB socket without any authentication, HMAC verification, or format validation, meaning any attacker who can reach the exposed endpoint over the network can send a crafted payload. Successful exploitation gives the attacker full code execution as the inference worker process on every connected reader worker in the cluster simultaneously. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ZMQ XPUB or SUB socket over the network; the vulnerable endpoint is exposed as a network-accessible service within the cluster.

• AuthenticationNot required

  The ZMQ socket accepts connections and data with no authentication, HMAC, or credential check of any kind.

• Victim interactionNot required

  No user interaction is needed; the deserialization executes automatically when the worker processes the incoming message.

• Attack complexityDetail

  Exploit reliability is high under normal conditions, though a specific attack path (reaching the writer XPUB endpoint or supplying a forged Handle with an attacker-controlled remote_subscribe_addr) introduces a conditional environmental factor.

Blast Radius

• The attacker executes arbitrary operating-system commands as the inference worker process, gaining full control of that process's privileges and filesystem access.
• Because the payload is broadcast, code execution triggers simultaneously on every remote reader worker subscribed to the channel, not just a single node.
• The attacker can read model weights, inference inputs, outputs, and any secrets or credentials accessible to the worker process.
• The attacker can modify or corrupt inference outputs, inject poisoned results into downstream consumers, or terminate worker processes to disrupt the inference service.