Description

An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-11T21:17:30.880Z",
  "pubdate": "2026-08-11T21:17:30.880Z",
  "executiveSummary": "An insecure handling of serialized objects vulnerability has been identified within a service of the GMS application version 9.5.1 (Build 9510.1044) and all preceding versions. This vulnerability stems from the unsafe processing of untrusted serialized data structures by the affected service component.\nThe primary impact of this security flaw allows a localized threat actor to execute unauthorized actions directly through the compromised component, potentially undermining the integrity and confidentiality of the underlying host environment.\nThe affected systems comprise GMS application deployments running version 9.5.1 (Build 9510.1044) and earlier iterations. Risk implications include unauthorized functional execution and potential system compromise depending on the privileges of the targeted service.\nTo successfully exploit this vulnerability, an attacker requires local access capabilities to interact directly with the vulnerable service running on the host system. The exploitation vector relies on the ability to supply maliciously crafted serialized payloads that the application parses and instantiates without proper validation or filtering mechanisms.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of serialized objects within one of the internal services of the GMS application. Specifically, the affected service accepts serialized data streams from local sources and instantiates the objects without implementing robust type-checking, allowlisting, or secure deserialization wrappers.\nThe vulnerable component processes untrusted byte streams, which allows an attacker capable of local interaction to supply a specially crafted gadget chain or malicious object payload. When the service deserializes the input, the underlying object lifecycle methods (such as readObject) are automatically invoked, triggering arbitrary code execution or unauthorized operational logic depending on the classes present in the application classpath.\nThe attack flow proceeds as follows: First, the local attacker crafts a serialized payload designed to leverage existing application classes or libraries (gadgets) that perform dangerous operations upon instantiation or state reconstruction. Second, the attacker interacts with the vulnerable GMS service interface to transmit the malicious payload into the deserialization routine. Third, the service ingests the byte stream and executes the parsing logic. Fourth, the insecure deserialization process reconstructs the object graph, executing the embedded instructions or triggering unauthorized state changes within the context of the service.\nThe affected versions are explicitly GMS application 9.5.1 (Build 9510.1044) and all prior versions. The authentication and privilege requirements necessitate that the attacker possesses local access capabilities and the ability to interact with the specific vulnerable service. Network exposure is local, meaning remote exploitation over standard network interfaces is not inherently described unless secondary pivoting or local access vectors (such as local shell access or compromised user sessions) are established. Post-exploitation impact includes the execution of unauthorized actions, potential escalation of privileges locally, and compromise of application functionality managed by the affected service."
}