PT-2025-38055 · Unknown · Jaspersoft Library

Published 2025-09-16 · Updated 2026-03-10 · CVE-2025-10492

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jaspersoft Library (affected versions not specified)

Description A Java deserialisation issue has been identified in Jaspersoft Library. Improper handling of externally supplied data could allow attackers to execute arbitrary code remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-10492

GHSA-7C3F-CG9X-F3GR

ZDI-25-948

Affected Products

Jaspersoft Library

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2025-10492 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10492 · Vendor Advisory
• https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7c3f-cg9x-f3gr · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-948 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-10492 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-10492 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-10492 · Vendor Advisory
• https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 · Note
• https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 · Note
• https://github.com/Jaspersoft/jasperreports · Note
• https://github.com/Jaspersoft/jasperreports/issues/542 · Note
• https://t.me/CVEtracker/32662 · Telegram Post
• https://twitter.com/SystemTek_UK/status/1977062211261472900 · Twitter Post
• https://t.me/cveNotify/138489 · Telegram Post