This vulnerability in Oracle Java SE's 2D component allows unauthenticated remote attackers to cause a denial of service (hang or crash) via multiple network protocols. It affects versions 25.0.4 and 26.0.2. The attack surface includes APIs that may be accessed through web services or sandboxed Java applications that load untrusted code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network attack vector, low complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among 943 fixes, emphasizing the importance of applying patches to supported versions.

Successful exploitation results in a complete denial of service of Oracle Java SE by causing the process to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of disruption in environments running affected Java SE versions.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed by the vendor advisory linked, indicating that fixes are available. No alternative mitigations or workarounds are specified in the advisory.