CVE-2025-47771: high-severity vulnerability in powsybl-core
PowSyBl Core allows deserialization of untrusted SparseMatrix data
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.5%
PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Affected products
powsybl · powsybl-coreRelated CVEs — powsybl-core
In the same product, most dangerous first.
CVE-2026-55673HIGHPowSyBl: Command Injection in LocalCommandExecutor-sEPSS 0.6%CVE-2025-48059LOWPowSyBl Core Contains a Polynomial ReDoS in RegexCriterionEPSS 0.6%CVE-2025-47293LOWPowSyBl Core XML Reader allows XXE and SSRFEPSS 0.4%CVE-2025-48058MEDIUMPowSyBl Core contains Polynomial REDoS’esEPSS 0.4%