This Red Hat security advisory covers the OpenJDK 25.0.3 update for Windows builds, which replaces version 25.0.2. It includes security fixes for nine vulnerabilities (CVE-2026-22007, CVE-2026-22008, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282) affecting cryptographic algorithm support, memory allocation, Kerberos credentialing, path factories, zip file reading, certificate chain validation, FreeType library, TLS connection handling, and key generation within the OpenJDK runtime and SDK. The advisory is rated as important by Red Hat Product Security. No CVSS scores are provided in the advisory, and no exploits are known to be active in the wild.

The vulnerabilities addressed impact cryptographic operations, memory management, authentication mechanisms, file path processing, archive handling, certificate validation, font rendering, TLS connections, and key generation within OpenJDK 25 on Windows. These issues could potentially affect the security posture of applications relying on OpenJDK 25 by weakening cryptographic assurances or causing incorrect processing of security-critical data. However, no known exploits in the wild have been reported at this time.

A security update to OpenJDK 25.0.3 for Windows is available from Red Hat and should be applied to replace version 25.0.2. Users should ensure all previously released errata relevant to their system are applied before updating. Detailed update instructions are available in the Red Hat advisory and documentation. No additional mitigation steps are indicated beyond applying this official update.