Untrusted data deserialization in the Azure SDK for Python creates a remote code execution vulnerability that allows an off‑network attacker to run arbitrary code on any host processing the data. The flaw is classed as CWE‑502 and carries a very high severity indicated by a CVSS score of 9.8, reflecting both the ability to compromise confidentiality, integrity, and availability of the affected system.

Microsoft Azure AI Language Authoring and Azure Conversation Authoring Client Library for Python (v1.0.0 beta1, beta2, and beta3) are affected. Applications that import these libraries and process data from untrusted sources are at risk.

The CVSS score of 9.8 signals a critical risk, while the EPSS score of < 1 % indicates that, although the likelihood of exploitation in the current population is low, the vulnerability remains dangerous. The attack vector is inferred to be remote over the network, whereby the attacker sends crafted data to the SDK, triggering code execution. The vulnerability is not listed in the CISA KEV catalog, but the impact of successful exploitation would be complete compromise of any host running the vulnerable SDK.