Deserialization Vulnerability in lm-sys FastChat Product
CVE-2025-3677

4.8MEDIUM

Key Information:

Vendor

Lm-sys

Status
Fastchat
Vendor
CVE Published:
16 April 2025

What is CVE-2025-3677?

A deserialization vulnerability has been discovered in lm-sys FastChat that affects the apply_delta_low_cpu_mem function within the file fastchat/model/apply_delta.py. Exploiting this vulnerability may allow attackers to manipulate data processed by the function, leading to potential security risks. This issue necessitates local access to the affected system, suggesting that physical or network proximity is essential for successful exploitation. Users of lm-sys FastChat should apply mitigations to prevent unauthorized access and ensure system integrity.

Affected Version(s)

fastchat 0.2.0

fastchat 0.2.1

fastchat 0.2.2

References

https://vuldb.com/?id.304966
vdb-entrytechnical-description
https://vuldb.com/?ctiid.304966
signaturepermissions-required
https://vuldb.com/?submit.552755
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ybdesire (VulDB User)
.