This vulnerability in the 2D component of Oracle Java SE and Oracle GraalVM products affects multiple specified versions. It is difficult to exploit and requires network access but no authentication. Successful exploitation results in unauthorized partial denial of service. The issue applies to client-side Java deployments that load untrusted code relying on the Java sandbox for security, not to server-side deployments with trusted code. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and low availability impact. No official remediation level or patch is explicitly stated in the advisory. The vendor advisory recommends applying patches from the July 2026 Critical Patch Update, but no direct patch link or fix for this specific vulnerability is provided in the input data.

An unauthenticated attacker with network access can exploit this vulnerability to cause a partial denial of service in affected Oracle Java SE and GraalVM versions. The impact is limited to availability with no confidentiality or integrity compromise. The vulnerability affects client-side Java applications that run untrusted code in sandboxed environments, potentially disrupting service or functionality partially. Server-side deployments running only trusted code are not affected.

The vendor advisory from Oracle (July 2026 Critical Patch Update) recommends applying security patches promptly to address vulnerabilities. However, no specific patch or remediation level is confirmed for this vulnerability in the provided data. Organizations should monitor the Oracle advisory for updates and apply any relevant patches when available. Since the vulnerability affects sandboxed client-side Java applications running untrusted code, limiting or avoiding the use of such applications may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.