CVE-2026-112858

Summary

The Rhodos application (versions through 1.3.3) is vulnerable to deserialization of untrusted data (CWE-502), allowing attackers to inject malicious objects during deserialization, potentially leading to remote code execution or other serious impacts.

Exploitability

Exploitation requires sending a specially crafted serialized object to an affected endpoint; no authentication or user interaction is needed due to the CVSS vector.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability loss, as indicated by the CVSS score of 9.8.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Rhodos version 1.3.4 or later, which contains a fix for this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.