CVE-2025-10492: Jaspersoft Library Deserialisation Vulnerability
Published Sep 16, 2025
·Updated
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Affected Software
9 affected components
Jaspersoft Jaspersoft Library
Cloud Jasperreports Io<=4.0.0
Cloud Jasperreports Io<=4.0.0
Cloud Jasperreports Library<=7.0.3
Cloud Jasperreports Library<=9.0.2
Cloud Jasperreports Server<=9.0.0
Cloud Jasperreports Studio<=7.0.3
Cloud Jasperreports Studio<=9.0.2
Cloud Jasperreports Web Studio<=3.0.1
Event History
Sep 16, 2025
CVE Published
via MITRE·04:41 PM
Data Sourced
via MITRE·04:41 PM
DescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-10492?
CVE-2025-10492 is rated as a critical vulnerability due to its potential for arbitrary code execution.
2
How do I fix CVE-2025-10492?
To fix CVE-2025-10492, upgrade to the latest version of Jaspersoft Library that addresses this vulnerability.
3
What systems are affected by CVE-2025-10492?
CVE-2025-10492 affects systems utilizing Jaspersoft Library that improperly handle externally supplied data.
4
What type of vulnerability is CVE-2025-10492?
CVE-2025-10492 is a Java deserialization vulnerability that can lead to remote code execution.
5
Who is the vendor for CVE-2025-10492?
The vendor for CVE-2025-10492 is Jaspersoft, responsible for the Jaspersoft Library.