This vulnerability affects Oracle Java SE version 8u491 in the JavaFX component. An unauthenticated attacker with network access can exploit this issue via multiple protocols to cause a partial denial of service condition. The attack vector involves using APIs exposed by the component, including scenarios where sandboxed Java Web Start applications or applets load untrusted code and rely on the Java sandbox for security. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability (partial DOS). No confidentiality or integrity impacts are noted. The vulnerability is identified as CWE-770 (Allocation of Resources Without Limits or Throttling).

Successful exploitation results in unauthorized ability to cause a partial denial of service of Oracle Java SE, impacting availability. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 does not explicitly list a patch for this specific vulnerability. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is released, consider limiting network exposure of affected Java SE 8u491 deployments and avoid running untrusted code in sandboxed Java environments if possible.