The vulnerability is a deserialization flaw that permits the injection of malicious objects into OpenText RightFax running on Windows 32‑bit and 64‑bit systems. An attacker can exploit this weakness to cause arbitrary code execution within the application and potentially gain full control of the underlying operating system. The flaw arises because untrusted data is deserialized without proper validation, enabling an attacker to craft payloads that execute arbitrary code.

The issue affects OpenText RightFax software through version 25.4. All installations on Windows 32‑bit and 64‑bit platforms that have not upgraded to the latest available release are vulnerable. Users should consult OpenText for a patched version that resolves the deserialization flaw.

The CVSS score of 9.3 indicates a high‑severity vulnerability. EPSS data is unavailable and the flaw is not documented in CISA's Known Exploited Vulnerabilities catalog, so the exact exploitation probability is uncertain. Nevertheless, the attack vector is inferred to be remote, most likely via network interfaces or file uploads that the application processes. If the RightFax server is exposed to untrusted networks, an attacker could leverage this weakness to achieve remote code execution before a patch is applied.