Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network, granting full control over the affected system and compromising confidentiality, integrity, and availability.

Microsoft Nuance PowerScribe 360 versions 4.0 through 4.0.9 and Microsoft Nuance PowerScribe One versions 2019.1 to 2019.9, as well as the 2023.1 SP2 Patch 11 and 2023.1 SP3 Patch 6 releases.

The flaw carries a CVSS score of 9.8, indicating a critical risk. EPSS data is not available, so the likelihood cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote over the network by sending a crafted serialized payload to the vulnerable application. No authentication requirements are explicitly mentioned, suggesting that an unauthenticated attacker with network access could exploit the weakness and achieve remote code execution.