CVE-2026-112852: Deserialization of Untrusted Data in ThemeREX Group Helion

The vulnerability CVE-2026-112852 affects ThemeREX Group Helion versions up to 1.1.12. It is caused by insecure deserialization of untrusted data, enabling an attacker to perform object injection. This can result in arbitrary code execution or other malicious actions compromising the system. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction but requires high attack complexity. No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability can lead to full compromise of confidentiality, integrity, and availability of the Helion application and potentially the underlying system. Due to object injection via deserialization, attackers may execute arbitrary code or manipulate application behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid processing untrusted serialized data or apply application-level controls to restrict deserialization inputs.