The flaw arises from the deserialization framework accepting attacker-specified classes within generic arguments of a class-name type ID, while validating only the outer class against the declared base type. The validator checks each argument against the outer type rather than the specific generic binding, enabling an attacker to embed a malicious class inside a wrapper or array. Because the framework treats such inner classes as valid, even though they would be rejected as direct type IDs, the validation added to fix a prior issue (CVE-2026-54512) is circumvented. This allows an attacker to force instantiation of arbitrary Java objects, including those that perform dangerous operations such as loading XML or executing system commands. In environments using default Jackson 3.x JsonMapper or default typing enabled in Jackson 2.x and 3.x, gadget chains can be deployed by sending crafted payloads, granting the attacker full code execution on the host.

The vulnerability affects the jackson-databind library provided by the FasterXML organization, namely com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. Versions 2.10.0 and later of the 2.x line, and 3.0.0 and later of the 3.x line, are vulnerable; earlier releases are not affected because the PolymorphicTypeValidator was introduced in 2.10.0. These components are widely used in Java applications that deserialize JSON, including Spring-based services, so any installation of a vulnerable package that employs default or generic type handling is at risk.

The CVSS score is 9.8, indicating critical severity. The EPSS score is 1% and the vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been documented. Based on the description, the likely attack vector is the delivery of crafted JSON or XML payloads that exploit Jackson's default or generic type handling to coerce deserialization of arbitrary classes. Successful exploitation would enable an attacker to execute arbitrary code under the privileges of the running Java application, potentially compromising the entire system.