This vulnerability in stmcan RT-Theme 18 | Extensions involves deserialization of untrusted data, which enables object injection attacks. Such vulnerabilities can allow attackers to execute arbitrary code, manipulate data, or cause denial of service. The affected product versions include all releases through version 2.5. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized code execution, data manipulation, and service disruption. The critical CVSS score reflects the high risk of remote exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting use of the affected extensions and monitor for any suspicious activity related to deserialization processes.