The Red Hat Security Advisory RHSA-2026:9254 addresses multiple vulnerabilities in the java-11-openjdk packages with Extended Lifecycle Support for RHEL 7, 8, and 9. The vulnerabilities include out-of-bounds reads (CVE-2025-66293), integer truncation leading to information disclosure and denial of service (CVE-2026-22801), heap buffer overflow (CVE-2026-25646), buffer overflow causing denial of service (CVE-2026-26740), use-after-free leading to arbitrary code execution (CVE-2026-33416), and other issues causing denial of service and information disclosure. The advisory lists a total of 15 CVEs affecting the JDK's image processing libraries and other components. The update is available from Red Hat and applies to OpenJDK 11 ELS packages for RHEL 7, 8, and 9.

The vulnerabilities collectively allow for potential denial of service, information disclosure, and arbitrary code execution within the Java runtime environment. This can affect applications running on the affected OpenJDK 11 versions on Red Hat Enterprise Linux 7, 8, and 9. Exploitation could lead to system instability, leakage of sensitive information, or execution of malicious code under the privileges of the Java process.

Red Hat has released updated java-11-openjdk packages with Extended Lifecycle Support that address these vulnerabilities. Users should apply this security update promptly. Before applying the update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official advisory RHSA-2026:9254 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No indication of known exploits in the wild has been reported.