The vulnerability allows a bypass of the PolymorphicTypeValidator in Jackson-databind by manipulating generic type arguments and array element types. This flaw enables an attacker to instantiate arbitrary Java classes during deserialization, providing a vector for executing malicious code. The flaw originates from a logic error that does not fully enforce type restrictions, and the CVE description indicates it is an incomplete fix for an earlier issue.

Jackson-databind library from the com.fasterxml package is affected. No specific product versions are listed in the data, so any installation of this library that has not been patched may be vulnerable.

The CVSS score of 8.1 categorizes this issue as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting that publicly known exploit activity is not documented. Based on the description, the likely attack vector is the delivery of crafted serialized data to a service that uses Jackson-databind to deserialize untrusted input. An attacker could exploit this to gain the privileges of the application process.