This vulnerability arises from the deserialization of untrusted data in Microsoft’s Azure Core shared client library for Python. An attacker who has authorized network access can craft a malicious payload that the library deserializes, leading to the execution of arbitrary code on the host where the library runs. The weakness is classified as CWE-502, indicating that untrusted input is processed without adequate validation.

The Azure Core shared client library for Python, as identified under Microsoft’s product records, is affected. All installations matching the generic package name azure_core_shared_client_library or the Python‑specific distribution azure_core_shared_client_library_for_python are potentially vulnerable; specific affected revisions are not listed in the record, so users should verify the library version in use and consider upgrading.

The CVSS score of 7.5 marks this as a high‑severity issue, while the EPSS score of 2% indicates a modest likelihood of exploitation at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker with authorized access to network traffic that can deliver the crafted payload to the library; it does not facilitate unauthenticated or remote code execution without some level of network connectivity to the target service.