This vulnerability in the ImageIO component of Oracle Java SE and related GraalVM products allows an unauthenticated network attacker to compromise data integrity by unauthorized modification (update, insert, delete) of accessible data. The attack surface includes APIs exposed via multiple protocols and sandboxed Java Web Start applications or applets that load untrusted code relying on the Java sandbox. The CVSS 3.1 base score is 3.7, reflecting a low-severity integrity impact with high attack complexity and no privileges or user interaction required. The vendor advisory does not explicitly confirm patch availability or remediation level for this specific issue but references a Critical Patch Update containing many patches. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized modification (update, insert, or delete) of data accessible through Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. There is no impact on confidentiality or availability. The vulnerability affects data integrity only and is considered difficult to exploit.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a specific patch is confirmed, users should follow Oracle's general security recommendations and avoid running untrusted code in sandboxed Java environments.