Is CVE-2026-12252 actively exploited?

No active exploitation of CVE-2026-12252 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-12252 be exploited remotely?

No. CVE-2026-12252 requires local access to exploit.

What is the CVSS score of CVE-2026-12252?

CVE-2026-12252 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-12252

HIGH

CVE-2026-12252

CWE-94Published: July 4, 2026· Updated: Jul 8, 2026

7.8

CVSS v3.1

EPSS:0.15%probability of exploitation in 30 daysPercentile:4.6th

Official Description

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.

NVD Source

Technical Analysis

CVE-2026-12252 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.