The vulnerability arises from accepting serialized Java lambda objects without adequate validation, enabling an attacker to supply a SerializedLambda that bypasses the normal class-registration checks during deserialization. This flaw satisfies CWE‑502 and could allow arbitrary code to be loaded and executed on the target JVM, potentially compromising confidentiality and integrity of the host system. The issue affects only the lambda capture class; however, if that class is used in application logic, the impact could extend to the entire application scope.

The flaw resides in Apache Fory provided by the Apache Software Foundation. All releases before version 1.4.0 are susceptible, as the patch that removes the auto‑admitted lambda handling was introduced in that release.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted serialized lambda payload to a component that processes untrusted data, allowing the attacker to bypass class‑registration checks and potentially execute arbitrary code. Although exploitation requires a deserialization endpoint, if such an endpoint exists the high CVSS score indicates severe potential impact.