The vulnerability arises from a component loading mechanism that accepts externally controlled input to specify a type to instantiate. The mechanism will construct and run the specified type, even if it is an invalid component, allowing execution of arbitrary constructor code. Because the constructor runs with the privileges of the service account, a successful exploitation results in code execution with those privileges. This flaw implements an uncontrolled class instantiation weakness, mapped to CWE-470.

Grid Protection Alliance products openPDC (including the Docker image) and openHistorian are affected. Versions before openPDC 2.9.477 and before openHistorian 2.8.580 contain the vulnerability; the fixes were released in those subsequent releases and incorporate additional verification and integrity checks for adapters.

The CVSS score of 7.7 indicates a high severity vulnerability. EPSS is not available, so the current estimation of exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploited versions. The attack requires an authenticated user who can place a file on the host filesystem and cause the affected service to load a malicious component. The likely attack vector therefore involves local or network-based authentication and file write capabilities, with the attacker able to influence the component loader to instantiate attacker-specified code.