The vulnerability resides in logback-core’s handling of logback.xml files. An attacker who can write to an existing configuration file can embed an instance declaration of any class that is already present on the Java classpath. When the offending file is processed, the class is instantiated. If the attacker chooses a malicious class, this step can lead to code execution. The weakness falls under unvalidated input and memory safety, corresponding to CWE‑20. The instance is typically discarded after instantiation, but the mere ability to create arbitrary objects on the classpath is a potential exploitation vector for more persistent attacks.

QOS.CH Sarl’s Logback‑core library is affected. Any Java application that includes logback‑core version 1.5.24 or earlier is vulnerable. The CVE references the core module (logback‑core) and does not affect other Logback components. No specific operating system or deployment platform is mentioned; the issue arises wherever the vulnerable library is used.

Scores reflect a low severity: CVSS base of 1.8 and an EPSS score lower than 1 %. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to modify a configuration file that is readable and writable by them, typically a local or compromised privilege scenario. The exposure surface is limited to Java applications that ship with or load an editable logback‑xml file. Because the instance is often discarded immediately, the risk of persistence is low, but the ability to create arbitrary classes remains an attack path that could be leveraged if the chosen class performs harmful operations.