This vulnerability in Oracle Java SE and related products affects the 2D component and is exploitable by unauthenticated attackers over the network via multiple protocols. Exploitation can cause a partial denial of service, impacting availability. The flaw can be triggered through APIs, including those used by sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and impact limited to availability. Affected versions include Oracle Java SE 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK 17.0.19 and 21.0.11; and Oracle GraalVM Enterprise Edition 21.3.18. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches. No known exploits in the wild have been reported.

Successful exploitation results in unauthorized ability to cause a partial denial of service (partial DOS) affecting availability of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. No specific temporary mitigations are provided in the advisory.