This vulnerability affects Oracle Java SE version 8u491 in the JavaFX component. An unauthenticated attacker with network access can exploit this flaw via multiple protocols to cause a partial denial of service condition. The vulnerability can be triggered through APIs, including those used by sandboxed Java Web Start applications or applets running untrusted code relying on the Java sandbox. The CVSS 3.1 vector indicates no confidentiality or integrity impact, only availability impact (partial DOS). Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE at this time.

Successful exploitation results in unauthorized ability to cause a partial denial of service of Oracle Java SE. There is no impact on confidentiality or integrity. The vulnerability is exploitable remotely without authentication and requires no user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, consider restricting network access to vulnerable Java SE instances and avoid running untrusted Java Web Start applications or applets.