Marko-M Quick Count versions up to 3.00 suffer from a deserialization of untrusted data vulnerability that permits object injection attacks. This vulnerability enables an attacker to send crafted serialized data to the application, potentially resulting in arbitrary code execution or other malicious impacts. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with no authentication or user interaction needed. No vendor patch or fix information is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code, manipulate data, or cause denial of service on affected installations of Marko-M Quick Count. The critical CVSS score indicates a severe risk to system security and operational stability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network exposure of the affected application and monitoring for suspicious activity related to deserialization inputs. Avoid processing untrusted serialized data where possible.