This vulnerability in baptiste.gourdin Talkback affects versions up to and including 1.0. It arises from unsafe deserialization of untrusted data within the talkback-secure-linkback-protocol component, enabling an attacker to perform object injection. The vulnerability is remotely exploitable without authentication or user interaction, leading to full compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with a score of 9.8, reflecting critical severity. No patch or vendor advisory is currently provided.

Successful exploitation allows an attacker to remotely execute arbitrary code or manipulate application logic via object injection, resulting in complete compromise of confidentiality, integrity, and availability of the affected Talkback system. This can lead to data breaches, system takeover, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable Talkback service to trusted networks only. Monitor vendor channels for updates and apply patches promptly once released.