The vulnerability is a Java Deserialization flaw in the Jaspersoft Reports Library that enables an attacker to run arbitrary code on the affected system. The flaw is rated as a high‑severity issue with a CVSS score of 8.7, indicating significant potential impact on confidentiality, integrity, and availability in affected environments.

The flaw affects multiple Jaspersoft products, including JasperReports IO At‑Scale, JasperReports IO Professional, JasperReports Library Community Edition, JasperReports Library Professional, JasperReports Server, JasperReports Web Studio, Jaspersoft Studio Community Edition, and Jaspersoft Studio Professional. Specific version information is not supplied in the advisory, so all builds of these products should be verified against the vendor’s patch guidance.

Because the flaw involves deserialization of untrusted data, the likely attack vector is remote, where an attacker can supply malicious serialized objects to a vulnerable component. The high CVSS score reflects the seriousness of the potential exploitation, but the EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, the possibility of remote code execution warrants immediate attention.