An application uses a serialized object from user input. An attacker provides a malicious serialized onject. What vulnerability could this be$?$