The vulnerability arises because the JAXB factory methods rely solely on the `FEATURE_SECURE_PROCESSING` flag to prevent XML External Entity resolution. In JAXP implementations that do not enforce this setting strictly, an attacker who can supply untrusted XML to the JAXB unmarshaller can trigger an out‑of‑band XXE, allowing the application to read local files. This results in confidential data disclosure to the attacker, as described by CWE-611.

The affected component is the Eclipse Foundation JAXB RI core library. No specific version range is provided, so any build of the library that uses the default factory initialization may be vulnerable.

The CVSS score of 8.3 indicates high severity, and while the EPSS score is not available, the fact that the flag is not universally respected in some JAXP implementations presents a realistic exploitation opportunity. The vulnerability is not listed in the CISA KEV catalog, but an attacker could still obtain XML processing intent from the target application. Successful exploitation would allow the attacker to read arbitrary files on the host, potentially exposing secrets or configuration data.