GCVE-1988-2026-0075
Vulnerability from gna-1988 β Published: 2026-09-07 13:20 β Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags
Summary
Chronicle Wire permits YAML type tags supplied within serialized input to
influence Java class selection and object instantiation during untyped
deserialization.
When applications deserialize attacker-controlled or otherwise untrusted
YAML through APIs such as readObject() or object(Object.class), an
externally controlled YAML type tag can identify a Java class that
Chronicle Wire resolves through its configured ClassLookup.
When the default permissive class lookup is used and the supplied class can
be resolved, the resulting class can propagate through Chronicle Wire's
generic object deserialization path and ultimately reach
ObjectUtils.newInstance(clazz). Chronicle Wire can then invoke the selected
class's deserialization lifecycle, including readMarshallable() where
applicable.
The security-sensitive behavior is therefore not limited to ordinary data
binding. Externally supplied serialized data can influence *which Java
class is instantiated during deserialization*.
The accompanying proof of concept confirms that:
- An externally controlled YAML type tag selects the Java class
instantiated by readObject().
- The selected class's constructor is executed.
- A selected class's readMarshallable() implementation is automatically
invoked during deserialization.
- An existing third-party class already present on the runtime classpath
can be instantiated using a YAML type tag.
- Configuring a restrictive ClassLookup prevents the demonstrated
arbitrary class selection.
The practical security impact depends on the classes available on the
target application's classpath and whether untrusted YAML reaches an
affected untyped deserialization API. The PoC establishes the arbitrary
class-selection and instantiation primitive but does not claim universal
arbitrary code execution.
Vulnerability Details
Chronicle Wire supports YAML type tags capable of identifying Java classes
during deserialization.
For example:
!fully.qualified.ClassName
The parser does not treat this value solely as descriptive metadata. The
supplied class name is resolved using the wire's configured ClassLookup.
The default wire configuration initializes the lookup using the global
alias pool:
protected ClassLookup classLookup =
ClassAliasPool.CLASS_ALIASES;
When a YAML TAG token is encountered, the supplied type is resolved:
Class<?> typePrefix() {
...
return classLookup().forName(stringBuilder);
}
The class represented by the serialized YAML can therefore influence the
Java type selected during deserialization.
In affected object-reading paths, Chronicle Wire can subsequently
instantiate the resolved class:
Class<?> clazz = typePrefix();
if (clazz != object.getClass())
object = ObjectUtils.newInstance(clazz);
The externally selected type can also propagate into the generic object
deserialization path:
Object o = typePrefixOrObject(clazz);
...
t = Wires.object2(..., (Class) o);
Within Wires.object2(), the type supplied by serialized input can replace
the caller's original type under several conditions:
if (clazz == null
|| clazz.isAssignableFrom(clazz2)
|| ReadResolvable.class.isAssignableFrom(clazz2)
|| !ObjectUtils.isConcreteClass(clazz))
{
clazz = clazz2;
}
Chronicle Wire can then instantiate the selected class:
if (o == null)
o = ObjectUtils.newInstance(clazz);
and continue the object's deserialization lifecycle:
Wires.readMarshallable(
clazz,
o,
in.wireIn(),
true);
As a result, when permissive class resolution is available, externally
controlled YAML can influence both the class instantiated by Chronicle Wire
and the class-specific deserialization logic subsequently executed.
Root Cause
The root cause is the use of serialized YAML type information to select
Java classes during generic or untyped object deserialization without a
mandatory deny-by-default class allow-list.
Chronicle Wire resolves externally supplied YAML type tags through its
configured ClassLookup. When the default permissive lookup permits the
requested type, the resulting class can propagate into generic object
deserialization and reach ObjectUtils.newInstance().
The security boundary becomes particularly important when an application
performs operations such as:
TextWire.from(untrustedYaml).readObject();
or equivalent untyped deserialization.
In this situation, the application is not exclusively determining the Java
class being constructed. The serialized YAML participates in that decision.
A restrictive ClassLookup can prevent arbitrary class resolution, but such
a restriction is not inherent to the demonstrated default deserialization
path.
Proof of Concept Results
The security test suite successfully reproduced multiple independent paths
in which serialized type information caused Chronicle Wire to instantiate
classes selected through the supplied Wire/YAML data.
The tests completed successfully with no failures or errors:
[INFO] Running net.openhft.chronicle.wire.SecurityAdditionalPoCTest
[INFO] Tests run: 13, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
Direct Tagged Class Instantiation
The PoC confirmed that Chronicle Wire resolves a supplied YAML type tag and
instantiates the corresponding Java class during deserialization.
Observed result:
WireObjectInput.readObject instantiated tagged class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$AdditionalTypedPathProbe
This confirms that the class encoded in serialized input is not merely
parsed as metadata. The resolved type reaches object construction and
results in an instance of the tagged class.
Map Value Type Instantiation
The same externally controlled type-selection behavior was reproduced while
deserializing a typed value contained within a map.
Observed result:
Map value read instantiated tagged class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$AdditionalTypedPathProbe
This demonstrates that the behavior is not limited to a single top-level
readObject() operation. Typed serialized values encountered within other
object-reading paths can also cause tagged classes to be instantiated.
File-Based Typed Deserialization
The PoC additionally confirmed arbitrary class instantiation when typed
serialized data is loaded from a caller-controlled file.
The test file contained:
!net.openhft.chronicle.wire.SecurityAdditionalPoCTest$FilePathProbe {
marker: from-file
}
The test output confirmed the exact payload written to the file:
WireType.fromFile payload written BEGIN
!net.openhft.chronicle.wire.SecurityAdditionalPoCTest$FilePathProbe {
marker: from-file }
WireType.fromFile payload written END
Chronicle Wire subsequently instantiated the class identified by the
serialized type tag:
WireType.fromFile instantiated tagged class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$FilePathProbe
This provides an additional concrete deserialization path where serialized
type information determines the Java class instantiated by Chronicle Wire.
Stream-Based File Deserialization
The same behavior was confirmed through the file-stream deserialization
path.
Observed result:
WireType.streamFromFile instantiated tagged class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$AdditionalTypedPathProbe
This demonstrates that externally supplied type information can reach class
instantiation through more than one Chronicle Wire input API.
Constructor and readMarshallable() Execution
The strongest lifecycle evidence was produced through a MethodReader typed
argument.
The serialized argument selected the following class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe
The test recorded both constructor and deserialization callback invocation:
MethodReader typed argument instantiated class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe
MethodReader typed argument constructor calls: 1
MethodReader typed argument readMarshallable calls: 1
This confirms that externally selected type information can result in more
than creation of an inert Java object.
For the selected class, Chronicle Wire caused:
-
the class to be resolved;
-
an instance to be constructed;
-
the constructor to execute; and
-
the class-specific readMarshallable() callback to execute.
The observed invocation counts were:
Constructor calls: 1
readMarshallable calls: 1
This provides direct evidence that class-specific executable lifecycle
behavior is reached as a consequence of serialized type selection.
Consolidated PoC Evidence
The test results demonstrate arbitrary class instantiation through several
Chronicle Wire deserialization paths:
-
WireObjectInput.readObject() instantiated an externally tagged class.
-
Map value deserialization instantiated an externally tagged class.
-
WireType.fromFile() instantiated the class identified by a YAML type tag
contained in a caller-controlled file.
-
WireType.streamFromFile() instantiated an externally tagged class.
-
MethodReader typed argument deserialization instantiated an externally
selected class.
-
Constructor execution was directly observed.
-
readMarshallable() execution was directly observed.
-
All 13 security tests completed without failure or error.
The most significant lifecycle result was:
MethodReader typed argument instantiated class:
net.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe
MethodReader typed argument constructor calls: 1
MethodReader typed argument readMarshallable calls: 1
Combined with the direct readObject(), map-value, fromFile(), and
streamFromFile() results, the PoC demonstrates that externally supplied
type information can influence Java class selection and cause the selected
class to be instantiated across multiple Chronicle Wire deserialization
surfaces.
The PoC does not rely solely on inspecting the source code or confirming
that a class name was successfully resolved. It observes actual object
construction and class-specific deserialization callback execution at
runtime.
PoC Conclusion
The test suite confirms the core security primitive described by this
finding: *serialized type information can control which Java class
Chronicle Wire instantiates during affected deserialization operations*.
The runtime evidence confirms both object construction and execution of
class-specific deserialization lifecycle behavior:
[CONFIRMED] Externally supplied type selected Java class
[CONFIRMED] Selected class instantiated
[CONFIRMED] Constructor executed
[CONFIRMED] readMarshallable() executed
[CONFIRMED] Typed class instantiated through readObject()
[CONFIRMED] Typed class instantiated through map value deserialization
[CONFIRMED] Typed class instantiated through WireType.fromFile()
[CONFIRMED] Typed class instantiated through WireType.streamFromFile()
[CONFIRMED] 13 security tests completed with 0 failures and 0 errors
These results establish the *arbitrary class selection and instantiation
primitive*. The ultimate security impact remains dependent on the classes
available on the target application's classpath and the trust boundary
through which serialized input reaches Chronicle Wire.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | Chronicle Wire |
Affected:
unknown
|
guessed |
{
"containers": {
"cna": {
"affected": [
{
"product": "Chronicle Wire",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Chronicle Wire permits YAML type tags supplied within serialized input to\ninfluence Java class selection and object instantiation during untyped\ndeserialization.\n\nWhen applications deserialize attacker-controlled or otherwise untrusted\nYAML through APIs such as readObject() or object(Object.class), an\nexternally controlled YAML type tag can identify a Java class that\nChronicle Wire resolves through its configured ClassLookup.\n\nWhen the default permissive class lookup is used and the supplied class can\nbe resolved, the resulting class can propagate through Chronicle Wire\u0027s\ngeneric object deserialization path and ultimately reach\nObjectUtils.newInstance(clazz). Chronicle Wire can then invoke the selected\nclass\u0027s deserialization lifecycle, including readMarshallable() where\napplicable.\n\nThe security-sensitive behavior is therefore not limited to ordinary data\nbinding. Externally supplied serialized data can influence *which Java\nclass is instantiated during deserialization*.\n\nThe accompanying proof of concept confirms that:\n\n - An externally controlled YAML type tag selects the Java class\n instantiated by readObject().\n - The selected class\u0027s constructor is executed.\n - A selected class\u0027s readMarshallable() implementation is automatically\n invoked during deserialization.\n - An existing third-party class already present on the runtime classpath\n can be instantiated using a YAML type tag.\n - Configuring a restrictive ClassLookup prevents the demonstrated\n arbitrary class selection.\n\nThe practical security impact depends on the classes available on the\ntarget application\u0027s classpath and whether untrusted YAML reaches an\naffected untyped deserialization API. The PoC establishes the arbitrary\nclass-selection and instantiation primitive but does not claim universal\narbitrary code execution.\nVulnerability Details\n\nChronicle Wire supports YAML type tags capable of identifying Java classes\nduring deserialization.\n\nFor example:\n\n!fully.qualified.ClassName\n\nThe parser does not treat this value solely as descriptive metadata. The\nsupplied class name is resolved using the wire\u0027s configured ClassLookup.\n\nThe default wire configuration initializes the lookup using the global\nalias pool:\n\nprotected ClassLookup classLookup =\n ClassAliasPool.CLASS_ALIASES;\n\nWhen a YAML TAG token is encountered, the supplied type is resolved:\n\nClass\u003c?\u003e typePrefix() {\n ...\n return classLookup().forName(stringBuilder);\n}\n\nThe class represented by the serialized YAML can therefore influence the\nJava type selected during deserialization.\n\nIn affected object-reading paths, Chronicle Wire can subsequently\ninstantiate the resolved class:\n\nClass\u003c?\u003e clazz = typePrefix();\n\nif (clazz != object.getClass())\n object = ObjectUtils.newInstance(clazz);\n\nThe externally selected type can also propagate into the generic object\ndeserialization path:\n\nObject o = typePrefixOrObject(clazz);\n\n...\n\nt = Wires.object2(..., (Class) o);\n\nWithin Wires.object2(), the type supplied by serialized input can replace\nthe caller\u0027s original type under several conditions:\n\nif (clazz == null\n || clazz.isAssignableFrom(clazz2)\n || ReadResolvable.class.isAssignableFrom(clazz2)\n || !ObjectUtils.isConcreteClass(clazz))\n{\n clazz = clazz2;\n}\n\nChronicle Wire can then instantiate the selected class:\n\nif (o == null)\n o = ObjectUtils.newInstance(clazz);\n\nand continue the object\u0027s deserialization lifecycle:\n\nWires.readMarshallable(\n clazz,\n o,\n in.wireIn(),\n true);\n\nAs a result, when permissive class resolution is available, externally\ncontrolled YAML can influence both the class instantiated by Chronicle Wire\nand the class-specific deserialization logic subsequently executed.\nRoot Cause\n\nThe root cause is the use of serialized YAML type information to select\nJava classes during generic or untyped object deserialization without a\nmandatory deny-by-default class allow-list.\n\nChronicle Wire resolves externally supplied YAML type tags through its\nconfigured ClassLookup. When the default permissive lookup permits the\nrequested type, the resulting class can propagate into generic object\ndeserialization and reach ObjectUtils.newInstance().\n\nThe security boundary becomes particularly important when an application\nperforms operations such as:\n\nTextWire.from(untrustedYaml).readObject();\n\nor equivalent untyped deserialization.\n\nIn this situation, the application is not exclusively determining the Java\nclass being constructed. The serialized YAML participates in that decision.\n\nA restrictive ClassLookup can prevent arbitrary class resolution, but such\na restriction is not inherent to the demonstrated default deserialization\npath.\nProof of Concept Results\n\nThe security test suite successfully reproduced multiple independent paths\nin which serialized type information caused Chronicle Wire to instantiate\nclasses selected through the supplied Wire/YAML data.\n\nThe tests completed successfully with no failures or errors:\n\n[INFO] Running net.openhft.chronicle.wire.SecurityAdditionalPoCTest\n\n[INFO] Tests run: 13, Failures: 0, Errors: 0, Skipped: 0\n\n[INFO] BUILD SUCCESS\n\nDirect Tagged Class Instantiation\n\nThe PoC confirmed that Chronicle Wire resolves a supplied YAML type tag and\ninstantiates the corresponding Java class during deserialization.\n\nObserved result:\n\nWireObjectInput.readObject instantiated tagged class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$AdditionalTypedPathProbe\n\nThis confirms that the class encoded in serialized input is not merely\nparsed as metadata. The resolved type reaches object construction and\nresults in an instance of the tagged class.\nMap Value Type Instantiation\n\nThe same externally controlled type-selection behavior was reproduced while\ndeserializing a typed value contained within a map.\n\nObserved result:\n\nMap value read instantiated tagged class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$AdditionalTypedPathProbe\n\nThis demonstrates that the behavior is not limited to a single top-level\nreadObject() operation. Typed serialized values encountered within other\nobject-reading paths can also cause tagged classes to be instantiated.\nFile-Based Typed Deserialization\n\nThe PoC additionally confirmed arbitrary class instantiation when typed\nserialized data is loaded from a caller-controlled file.\n\nThe test file contained:\n\n!net.openhft.chronicle.wire.SecurityAdditionalPoCTest$FilePathProbe {\n marker: from-file\n}\n\nThe test output confirmed the exact payload written to the file:\n\nWireType.fromFile payload written BEGIN\n!net.openhft.chronicle.wire.SecurityAdditionalPoCTest$FilePathProbe {\nmarker: from-file }\nWireType.fromFile payload written END\n\nChronicle Wire subsequently instantiated the class identified by the\nserialized type tag:\n\nWireType.fromFile instantiated tagged class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$FilePathProbe\n\nThis provides an additional concrete deserialization path where serialized\ntype information determines the Java class instantiated by Chronicle Wire.\nStream-Based File Deserialization\n\nThe same behavior was confirmed through the file-stream deserialization\npath.\n\nObserved result:\n\nWireType.streamFromFile instantiated tagged class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$AdditionalTypedPathProbe\n\nThis demonstrates that externally supplied type information can reach class\ninstantiation through more than one Chronicle Wire input API.\nConstructor and readMarshallable() Execution\n\nThe strongest lifecycle evidence was produced through a MethodReader typed\nargument.\n\nThe serialized argument selected the following class:\n\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe\n\nThe test recorded both constructor and deserialization callback invocation:\n\nMethodReader typed argument instantiated class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe\n\nMethodReader typed argument constructor calls: 1\nMethodReader typed argument readMarshallable calls: 1\n\nThis confirms that externally selected type information can result in more\nthan creation of an inert Java object.\n\nFor the selected class, Chronicle Wire caused:\n\n -\n\n the class to be resolved;\n -\n\n an instance to be constructed;\n -\n\n the constructor to execute; and\n -\n\n the class-specific readMarshallable() callback to execute.\n\nThe observed invocation counts were:\n\nConstructor calls: 1\nreadMarshallable calls: 1\n\nThis provides direct evidence that class-specific executable lifecycle\nbehavior is reached as a consequence of serialized type selection.\nConsolidated PoC Evidence\n\nThe test results demonstrate arbitrary class instantiation through several\nChronicle Wire deserialization paths:\n\n -\n\n WireObjectInput.readObject() instantiated an externally tagged class.\n -\n\n Map value deserialization instantiated an externally tagged class.\n -\n\n WireType.fromFile() instantiated the class identified by a YAML type tag\n contained in a caller-controlled file.\n -\n\n WireType.streamFromFile() instantiated an externally tagged class.\n -\n\n MethodReader typed argument deserialization instantiated an externally\n selected class.\n -\n\n Constructor execution was directly observed.\n -\n\n readMarshallable() execution was directly observed.\n -\n\n All 13 security tests completed without failure or error.\n\nThe most significant lifecycle result was:\n\nMethodReader typed argument instantiated class:\nnet.openhft.chronicle.wire.SecurityAdditionalPoCTest$MethodReaderProbe\n\nMethodReader typed argument constructor calls: 1\nMethodReader typed argument readMarshallable calls: 1\n\nCombined with the direct readObject(), map-value, fromFile(), and\nstreamFromFile() results, the PoC demonstrates that externally supplied\ntype information can influence Java class selection and cause the selected\nclass to be instantiated across multiple Chronicle Wire deserialization\nsurfaces.\n\nThe PoC does not rely solely on inspecting the source code or confirming\nthat a class name was successfully resolved. It observes actual object\nconstruction and class-specific deserialization callback execution at\nruntime.\nPoC Conclusion\n\nThe test suite confirms the core security primitive described by this\nfinding: *serialized type information can control which Java class\nChronicle Wire instantiates during affected deserialization operations*.\n\nThe runtime evidence confirms both object construction and execution of\nclass-specific deserialization lifecycle behavior:\n\n[CONFIRMED] Externally supplied type selected Java class\n[CONFIRMED] Selected class instantiated\n[CONFIRMED] Constructor executed\n[CONFIRMED] readMarshallable() executed\n[CONFIRMED] Typed class instantiated through readObject()\n[CONFIRMED] Typed class instantiated through map value deserialization\n[CONFIRMED] Typed class instantiated through WireType.fromFile()\n[CONFIRMED] Typed class instantiated through WireType.streamFromFile()\n[CONFIRMED] 13 security tests completed with 0 failures and 0 errors\n\nThese results establish the *arbitrary class selection and instantiation\nprimitive*. The ultimate security impact remains dependent on the classes\navailable on the target application\u0027s classpath and the trust boundary\nthrough which serialized input reaches Chronicle Wire.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/103"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/103"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/103"
],
"discovery": "EXTERNAL"
},
"title": "Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0075",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/103",
"automated": true,
"contentSha256": "373857b24efd6a689043e6cf615e0c3a0a62392da12986dc20b6425ac929092f",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/103",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:42:32Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0075"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦