CVE-2026-22008 is a heap-based buffer overflow vulnerability in Oracle Java SE 25.0.1 libraries, impacting sandboxed Java Web Start applications or applets that load untrusted code and rely on the Java sandbox for security. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause unauthorized update, insert, or delete access to some accessible data. The CVSS 3.1 base score is 3.7, reflecting low integrity impact with no confidentiality or availability impact. This vulnerability does not affect Java deployments running only trusted code, such as servers. Red Hat Hardened Images RPMs include affected components, but the Red Hat advisory does not currently provide a fix or patch. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow).

The vulnerability allows unauthorized modification of some accessible data with low integrity impact. It is difficult to exploit and requires network access but no privileges or user interaction. There are no known exploits in the wild. The vulnerability does not affect confidentiality or availability. It primarily impacts sandboxed Java clients running untrusted code, not server-side Java deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory does not currently list a fix for this vulnerability. Users should monitor Red Hat's official channels for updates and apply any future patches when available. Since the vulnerability affects sandboxed Java clients running untrusted code, limiting the execution of such code or restricting network access to vulnerable Java components may reduce exposure.