CVE-2025-32444 — AI Deep Analysis Summary

🚨 **Essence**: vLLM (versions 0.6.5 - 0.8.5) suffers from a critical code flaw. 📉 **Consequences**: Attackers can achieve **Remote Code Execution (RCE)** via malicious pickle serialization.…

🛡️ **Root Cause**: **CWE-502** (Deserialization of Untrusted Data). 🐛 **Flaw**: The engine blindly uses `pickle` for serialization.…

🎯 **Affected**: **vllm-project/vllm**. 📅 **Versions**: All releases from **0.6.5 up to 0.8.5**. 📦 **Component**: Specifically impacts the distributed KV transfer mechanisms (e.g., `mooncake_pipe.py`).…

💻 **Privileges**: **Full System Control**. 🌐 **Data**: Complete compromise of the host server. 🚀 **Action**: Hackers can execute **any command** on the server hosting the vLLM instance.…

🔓 **Threshold**: **LOW**. 🌍 **Access**: Network Accessible (AV:N). 🔑 **Auth**: **None Required** (PR:N). 👁️ **UI**: **None Required** (UI:N). 🤝 **Complexity**: **Low** (AC:L).…

🔥 **Public Exploit**: **YES**. 📂 **PoC Available**: Proof-of-Concept code is live on GitHub (`stuxbench/vLLM-CVE-2025-32444`). 🛠️ **Status**: Easy to run with Docker/UV.…

🔍 **Self-Check**: Scan for vLLM versions **0.6.5 - 0.8.5**. 📂 **Code Audit**: Look for `pickle.loads()` or `pickle.dumps()` in `vllm/distributed/kv_transfer/`.…

🛠️ **Fix**: Official patches are referenced in GitHub Security Advisories (GHSA-hj4w-hm2g-p6w5, GHSA-x3m8-f7g5-qhm7). 📝 **Commit**: Fix commit `a5450f11c95847cf51a17207af9a3ca5ab569b2c` is available.…

🚧 **Workaround**: If patching is impossible, **isolate** the vLLM service. 🚫 **Network**: Block all external access to the vLLM API port.…

🚨 **Urgency**: **CRITICAL / IMMEDIATE**. ⚡ **Priority**: **P0**. 📉 **Risk**: Unauthenticated RCE on production LLM infrastructure. 🏃 **Action**: Patch **NOW**.…