AI Tensor Engine for ROCm (AITER) contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py. The flaw permits an attacker to craft a malicious pickle payload that is sent to a ZMQ SUB socket without any authentication, HMAC, or format validation. Upon receipt, the worker process deserializes the pickle payload and executes arbitrary code, potentially compromising the inference worker or any remote reader operating within the cluster.

All deployments of ROCm:aiter using version 0.1.14 or earlier. The vulnerability is present in the MessageQueue.recv() implementation of shm_broadcast.py and affects any configuration that exposes the XPUB endpoint on the cluster network or accepts forged handles with attacker-controlled subscribe addresses.

The CVSS score of 9.2 classifies this as critical, exposing the system to arbitrary code execution with a local privilege escalation or full system compromise risk. No EPSS score is available, and the vulnerability is not yet listed in CISA KEV. Attackers would need network access to the XPUB endpoint or the ability to supply a forged handle; both conditions are likely met in an internal or improperly isolated cluster environment.