Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CWE-502