This vulnerability in Oracle Java SE's 2D component affects versions 25.0.4 and 26.0.2. It permits an unauthenticated attacker with network access to cause a hang or repeated crash, resulting in a complete denial of service. Exploitation can occur through APIs, including those used by sandboxed Java Web Start applications or applets that load untrusted code. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability (denial of service). Oracle has published a Critical Security Patch Update advisory recommending patch application, but no explicit patch links for these versions were provided in the input data.

Successful exploitation leads to denial of service by causing Oracle Java SE to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires network access but no authentication or user interaction. This can disrupt services relying on affected Java SE versions, especially those running sandboxed untrusted code.

Oracle strongly recommends applying the security patches provided in their August 2026 Critical Security Patch Update. Customers should remain on actively supported versions and apply patches without delay. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required. Patch status is not explicitly confirmed in the provided data; users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance and patch availability.