This vulnerability in EMV Creatify is classified as CWE-502: Deserialization of Untrusted Data. It allows attackers to inject malicious objects during the deserialization process, potentially leading to remote code execution or other severe impacts. The affected versions are all releases up to and including 1.5. No official patch or remediation guidance is currently documented, and no known exploits have been reported in the wild as of the publication date.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. Given the vulnerability allows object injection via deserialization of untrusted data, attackers may execute arbitrary code remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted serialized data with EMV Creatify versions up to 1.5. Monitor vendor channels for updates and apply patches promptly once released.