PowerDocu, a Windows GUI application for technical documentation, parses JSON files contained in Flow or App packages. The application blindly trusts the $type property in these JSON files, enabling an attacker to instantiate arbitrary .NET objects and execute code. This flaw is a classic example of insecure deserialization (CWE‑502) and can lead to arbitrary code execution on the host system.

The vulnerability affects all installations of PowerDocu prior to version 2.4.0. No specific sub‑versions are listed, so any release earlier than 2.4.0 is considered vulnerable.

The CVSS score of 7.8 indicates high impact, while the EPSS score of less than 1 % suggests exploitation is currently unlikely. Because the flaw is triggered when the application processes a malicious Flow or App package, the attack vector is likely local or remote depending on how the file is introduced. No report of active exploitation is in KEV catalog, but the high severity warrants prompt attention. The main prerequisite for exploitation is the ability to supply a crafted JSON file that the application will parse.