DTMSoft is vulnerable to deserialization of untrusted data, which can allow an attacker to execute arbitrary code. The weakness is a classic CWE‑502 flaw in which the program accepts arbitrary serialized input and processes it without adequate validation or sandboxing. If an attacker supplies a crafted project file, the application may instantiate malicious objects, leading to execution of attacker‑chosen code within the context of the running process.

The affected vendor is DeltaWW and the product is DTMSoft. No specific product versions are provided in the available data, so all current releases of DTMSoft could potentially be impacted unless a later version includes a fix.

The CVSS score of 8.4 indicates a high severity for this flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity but still a critical risk. Based on the description, the likely attack vector is the tampering of project files that the software loads; an attacker could supply a malicious file either from a local source, via an email attachment, or through a network share. Running the application with standard user privileges mitigates the potential damage, as the workaround advises not to use "Run as Administrator" when launching the software.