This vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affects the AWT and JavaFX components. It is exploitable remotely without authentication via multiple network protocols but requires user interaction from a third party. The vulnerability impacts sandboxed Java client deployments that load untrusted code, allowing attackers to perform unauthorized modification of critical data accessible through these Java environments. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, no confidentiality impact, high integrity impact, and no availability impact. Oracle’s January 2026 Critical Patch Update advisory includes patches addressing this and other vulnerabilities. No known exploits in the wild have been reported to date.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within affected Oracle Java SE and GraalVM environments. The vulnerability affects client-side Java deployments that run untrusted code in sandboxed contexts, potentially compromising data integrity. There is no direct impact on confidentiality or availability. The scope of impact may extend to additional products that rely on these Java components. Server-side Java deployments running only trusted code are not affected.

Oracle has released patches for this vulnerability as part of the January 2026 Critical Patch Update. Users should apply these official patches promptly to remediate the vulnerability. Since the vulnerability requires user interaction and affects sandboxed Java client deployments running untrusted code, restricting or disabling such deployments can reduce risk. No alternative mitigations or workarounds are specified in the vendor advisory. Patch status is confirmed by Oracle’s advisory at https://www.oracle.com/security-alerts/cpujan2026.html.