CVE-2025-67729

CVE-2025-67729 is an insecure deserialization vulnerability in LMDeploy versions prior to 0.11.1, affecting the toolkit used for compressing, deploying, and serving Large Language Models (LLMs). This flaw allows an attacker to execute arbitrary code on a victim's machine by crafting and distributing a malicious model checkpoint file (.bin or .pt) that is then loaded by the vulnerable LMDeploy instance. The vulnerability carries a CVSS score of 8.8 (HIGH), indicating a critical risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE.