This vulnerability (CVE-2025-60236) in EMV Creatify involves deserialization of untrusted data (CWE-502), which enables an attacker to perform object injection. The flaw affects Creatify versions up to 1.5, allowing remote attackers to execute arbitrary code or cause denial of service without authentication or user interaction. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and the remediation level is unknown.

Successful exploitation can lead to full compromise of the affected system, including remote code execution, data tampering, and denial of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly severe. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted serialized data in EMV Creatify. Monitor vendor communications for updates on patches or mitigations.