The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.