CVE-2026-112855

Summary

The Redy application before version 1.3.5 is vulnerable to deserialization of untrusted data (CWE-502), allowing attackers to inject malicious objects during deserialization, potentially leading to remote code execution or other serious impacts due to unsafe handling of serialized user input.

Exploitability

Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions—only sending a crafted serialized payload over the network.

Blast radius

Successful exploitation could lead to full system compromise including unauthorized access to sensitive data, modification of application behavior, or execution of arbitrary code on the affected server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Redy version 1.3.6 or later, as this is the first fixed version addressing the object injection vulnerability in the deserialization logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.