A deserialization flaw exists in the Workshop Scenario Loader component of Ndemic Creations Plague Inc Evolved up to version 1.24.0.3. By manipulating the serialized data passed to this function, an attacker may induce the application to deserialize crafted input, potentially leading to arbitrary code execution on the host. The vulnerability is not limited to local users and may be triggered remotely. The flaw is fixed in the next release.

The affected vendor is Ndemic Creations and the product is Plague Inc Evolved. All installations using version 1.24.0.3 or earlier are vulnerable. Versions from 1.24.0.4 onward contain the fix and are not affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote, as it states the attack may be performed from a remote location. Exploitation would require sending a malicious payload to the Workshop Scenario Loader, which could result in remote code execution if the application processes the payload without validation.