In the UYAP Document Editor on Windows, Linux, and MacOS, an untrusted data deserialization flaw permits object injection. The flaw exists in all releases before 5.4.20 on Windows and Linux, and before 5.4.21 on MacOS. Maliciously crafted serialized objects are processed by the editor, potentially enabling attackers to inject and execute arbitrary code, thereby compromising the host system and gaining full control.

The affected vendor is the Ministry of Justice General Directorate of Information Technology, deploying the UYAP Document Editor. Systems running any version prior to 5.4.20 are vulnerable on Windows and Linux; versions prior to 5.4.21 are vulnerable on MacOS. Versions 5.4.20 and newer on Windows and Linux, and 5.4.21 and newer on MacOS contain the fix.

The CVSS score of 8.8 indicates a high severity. EPSS is less than 1%, making the likelihood of exploitation low but nonzero. The vulnerability is not listed in CISA KEV, suggesting modest current exploitation activity. The likely attack vector is remote, as the deserialization occurs on data received from external clients. Attackers could deliver malicious payloads through the editor’s import or upload functionality unless defensive controls are in place.