The vulnerability involves the .NET Remoting framework used by OpenText RightFax. If the service is exposed in an environment where the remoting ports are reachable, an attacker can exploit known weaknesses in the framework. The flaw allows the injection of malicious objects during deserialization, enabling arbitrary code execution within the application and potentially full compromise of the underlying operating system.

The issue affects OpenText RightFax software. Users should consult OpenText for a patched version that resolves the deserialization flaw.

The CVSS score of 9.3 indicates a high severity vulnerability. The EPSS score of < 1% suggests that the exploitation probability is presently low, though not zero. The flaw is not listed in CISA's KEV catalog. The attack vector is inferred to be remote, most likely via the exposed remoting ports. If the RightFax server is exposed to untrusted networks, an attacker could leverage this weakness to achieve remote code execution before a patch is applied.