CVE-2025-15610

Received
Published: 15 Apr 2026, 16:31
Last modified:15 Apr 2026, 17:32

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.3 CRITICAL
v4.0 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Apr 2026, 16:31
Published
Vulnerability first disclosed
15 Apr 2026, 17:32
Last Modified
Vulnerability information updated

Description

Deserialization of untrusted data vulnerability in OpenText, Inc RightFax on Windows, 64 bit, 32 bit allows Object Injection.This issue affects RightFax: through 25.4.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • opentext, inc•rightfax

    ≥ 16.6, ≤ 16.6 Update7136 | ≥ 20.2, ≤ 20.2 Update5705 | ≥ 21.2, ≤ 21.2.1.2678 | ≥ 22.2, ≤ 22.2.2.347 | ≥ 23.4, ≤ 23.4.2.853 | ≥ 24.4, ≤ 24.4.2.853 | ≥ 25.4, ≤ 25.4.2.347

References (1)