Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CWE-502