PT-2025-40912 · Microsoft+1 · Windows+1

Manuel Feifel · Published 2025-10-06 · Updated 2025-10-09 · CVE-2025-10363

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Topal Solutions AG Topal Finanzbuchhaltung versions prior to 11.2.12.00

Description A flaw exists in Topal Solutions AG Topal Finanzbuchhaltung on Windows that allows for Remote Code Execution through deserialization of untrusted data. The issue is related to .NET deserialization and allows for unauthenticated Remote Code Execution.

Recommendations Update Topal Finanzbuchhaltung to version 11.2.12.00 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-10363

Affected Products

Topal Finanzbuchhaltung

Windows

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10363 · Security Note
• https://info.topal.ch/content/info/Topal_ReleaseNotes/de/version_v11_2_12_0.htm · Note
• https://twitter.com/SecAideInfo/status/1976230226137858109 · Twitter Post
• https://twitter.com/CVEnew/status/1975243680610197658 · Twitter Post
• https://twitter.com/0dayPublishing/status/1975243171043934503 · Twitter Post
• https://twitter.com/InfoGuard_Labs/status/1975465018780230050 · Twitter Post
• https://labs.infoguard.ch/advisories/cve-2025-10363_topal_deserialization_unauth_rce · Note