The vulnerability CVE-2025-60221 affects captivateaudio Captivate Sync (up to version 3.0.3) and involves deserialization of untrusted data, which allows an attacker to perform object injection. This type of vulnerability can enable remote code execution or other severe impacts by manipulating serialized objects. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and potential remote code execution. The critical CVSS score indicates severe impact on confidentiality, integrity, and availability. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to the affected service and monitor for suspicious activity related to deserialization attempts. Avoid processing untrusted serialized data if possible.