Themeton Acerola up to version 1.6.5 suffers from a CWE-502 deserialization of untrusted data vulnerability (CVE-2025-31927) that permits object injection attacks. This vulnerability can be exploited remotely without authentication or user interaction, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting the critical nature of this issue. No patch or official fix has been published yet, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability can lead to full system compromise, including unauthorized code execution, data manipulation, and denial of service. The critical CVSS score reflects the potential for severe impact on affected systems. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available temporary mitigations recommended by the vendor or restrict exposure of vulnerable instances to untrusted networks. Monitor vendor channels for updates.