A flaw in mchange-commons-java prior to version 0.6.0 allows its JNDI ObjectFactory to instantiate arbitrary Java classes and set JavaBean‑style properties without validation. When these properties belong to classes that perform side effects—such as Swing’s JEditorPane—the initialization can trigger external HTTP requests, enabling the attacker to transport data from a compromised application. This same vulnerable factory, together with the library’s ReferenceIndirector, permits an attacker to supply malicious JNDI Reference objects or serialized payloads that invoke deserialization gadgets, thereby creating a potential for arbitrary code execution.

Any deployment that incorporates mchange-commons-java versions earlier than 0.6.0 is vulnerable. The library is used by the c3p0 connection pool and other mchange projects; applications that rely on connection pooling, object serialization, or perform JNDI lookups may be affected. The vulnerability is not tied to a particular operating system or runtime; based on the description it is inferred that the flaw could surface on any Java environment that processes untrusted data through this library.

The CVSS score of 7.1 indicates significant severity, but the EPSS score of less than 1% reflects a low current exploitation probability. The issue is not listed in the CISA KEV catalog. Attackers could deliver malicious JNDI Reference objects or deserialized payloads that the application processes, possibly leading to arbitrary code execution or unauthorized network activity. Based on the description, it is inferred that the attack vector is likely through injection of JNDI references or untrusted serialized data, and the vulnerability applies across operating systems wherever the Java runtime is present.