The deserialization security issue is commonly seen in Java, and is a Remote Code Execution (RCE) attack. Serialization is the process in Java of converting the state of an object into a byte stream (serialized object), which can be stored in files, memory, or a database. Deserialization is the reverse process, creating an object based on the byte stream.
For the deserialization attack, the serialized object becomes one of untrusted data input for the receiver to do the deserialization. The attack may tamper with or replace the serialized object with malicious code. This can be referred to in CWE-502: Deserialization of untrusted data http://cwe.mitre.org/data/definitions/502.html
The serialized object can be stored or transmitted by memory, files, and networks. The hacker may...