CVE-2025-32444
Vllm remote code execution
- Published29 Apr 2025
Description
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack. vLLM instances that do not make use of the mooncake integration are not vulnerable. This issue has been patched in version 0.8.5.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
Remediation
Frequently asked
Is CVE-2025-32444 being actively exploited?
CVE-2025-32444 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.79%.
How severe is CVE-2025-32444?
CVE-2025-32444 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 1.79% probability of exploitation.
Which products are affected by CVE-2025-32444?
Affected products include Vllm.
How do I fix CVE-2025-32444?
Upgrade affected software to a fixed version, for example Vllm 0.8.5 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2025-32444 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.