The vulnerability allows an attacker who can influence the type identifier in a JSON payload to inject an arbitrary class into a generic type parameter of an approved container. The deserialization process then resolves and instantiates the target class via Class.forName, bypassing the PolymorphicTypeValidator. This permits the execution of arbitrary code, exposing the system to data tampering, privilege escalation, or full compromise. The weakness is a classic deserialization flaw (CWE-502) combined with inadequate validation of type references (CWE-184).

Customer software that integrates FasterXML’s jackson-databind library in versions starting with 2.10.0 up through 2.18.8, as well as 2.21.4 and 3.1.4, are affected. Applications that employ polymorphic deserialization and rely on the library’s PolymorphicTypeValidator would be susceptible. No other vendors are listed.

The CVSS score of 8.1 indicates a high risk, with potential for remote code execution if the application accepts untrusted JSON. Because no EPSS score is available and the vulnerability is not yet in the CISA KEV catalog, the public exploitation likelihood is unknown but could be significant in environments that facilitate uncontrolled JSON input. Attackers likely would exploit this via network services or APIs that deserialize incoming data.