Apache OpenNLP EUVD-2026-41885

Exploitation requires an application running the affected libsvm module (Apache OpenNLP 3.0.0-M1 up to <3.0.0-M4) to call the public static SvmDoccatModel.deserialize(InputStream) on a stream the attacker can influence - the entry point is unauthenticated and needs no user interaction (PR:N/UI:N). The decisive additional prerequisite, explicit in the description, is that a usable Java deserialization gadget chain must exist on the consuming application's classpath, because Apache OpenNLP ships no gadget of its own; without such a chain the payload deserializes but does not achieve code execution. Exploitation is thus limited by: (1) the application must actually deserialize untrusted or semi-trusted model streams rather than only trusted internal artifacts, (2) the specific optional libsvm module and vulnerable 3.x milestone version must be in use, and (3) a compatible gadget must be present in transitive dependencies - a condition outside the attacker's direct control that materially narrows real-world exploitability.

The vendor CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects a network-reachable, unauthenticated, no-interaction flaw but deliberately caps impact at Low/Low/Low rather than the High/High/High that full RCE would imply - a reasonable acknowledgement that code execution is conditional on a gadget chain being present on the consumer's classpath, a factor outside the attacker's control. SSVC aligns with this nuance: Exploitation is rated 'none' (no observed exploitation), Automatable 'yes' (the entry point is a public static method easily fed a payload at scale), and Technical Impact 'partial'. There is no KEV listing and no EPSS score provided, and POC availability is not indicated in the source data. The practical priority is therefore moderate and highly context-dependent: environments that call deserialize() on untrusted streams AND carry known-vulnerable gadget libraries face genuine RCE exposure, while those without a gadget chain face a much lower effective risk. Conflict to verify: the description characterizes the outcome as RCE while the scored impacts are only Low across C/I/A - the discrepancy is explained by gadget-chain dependency, not an error, but defenders should confirm their own classpath before deciding severity.

An application embeds the OpenNLP libsvm module and loads a document-categorization model by passing a user-supplied or externally fetched byte stream to SvmDoccatModel.deserialize(). An attacker submits a crafted serialized payload referencing a gadget chain already present in the app's transitive dependencies; readObject() instantiates the chain before the SvmDoccatModel cast, executing attacker code in the JVM. No POC is identified in the source data, and success depends on a suitable gadget being on the classpath (AV:N, AC:L per vendor vector).