The Red Hat security advisory RHSA-2026:11822 announces the release of OpenJDK 25.0.3 for Windows, which replaces the previous 25.0.2 version. This update includes security and bug fixes addressing nine distinct vulnerabilities (CVE-2026-22007, CVE-2026-22008, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282). These vulnerabilities impact cryptographic algorithm support, memory allocation (Arena allocations), Kerberos credentialing, path factory handling, zip file reading, certificate chain validation, FreeType library version, TLS connection handling, and key generation within the OpenJDK 25 runtime environment. The advisory rates the update as having an important security impact and recommends applying the update after prior errata. No CVSS scores are provided in the advisory, and no exploits in the wild are known.

The vulnerabilities fixed in this update affect critical components of the OpenJDK 25 runtime environment, including cryptographic operations, memory management, authentication mechanisms, file handling, and TLS connections. These issues could potentially allow attackers to undermine security guarantees related to encryption, authentication, and data integrity if exploited. However, no known exploits in the wild have been reported at this time. The update mitigates these risks by enhancing algorithm support, improving credential handling, fixing memory allocation issues, and updating third-party libraries such as FreeType.

A security update is available in the form of OpenJDK 25.0.3 for Windows, which replaces version 25.0.2. Users should apply this update to address the listed vulnerabilities. Before applying the update, ensure all previously released relevant errata have been installed. Refer to the Red Hat advisory RHSA-2026:11822 and the linked documentation for detailed update instructions. No additional mitigation steps are indicated by the vendor advisory.