CVE-2026-12613
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.
Risk Assessment
The risk includes potential arbitrary code execution, which could lead to system compromise or data theft.
Recommendation
Update UYAP Document Editor to version 5.4.20 (Windows/Linux) or 5.4.21 (MacOS) and restrict processing of untrusted data.
Other vulnerabilities in UYAP Document Editor
See all- CVE-2026-18390High
OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.
- CVE-2026-16999Medium
UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.
Original NVD description (English source)
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS