Serialization

That's serialization.

Right.

Deserialization is when the receiving server takes that string of text and automatically reconstitutes it back into a complex object in its own memory.

And the vulnerability arises because the application on the receiving end often blindly trusts the instructions embedded in that serialized string of text.

It assumes the text is just data.