A vulnerability (CVE-2025-30749) affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in their 2D component. It allows an unauthenticated attacker with network access via multiple protocols to potentially take over the affected products. The flaw mainly impacts Java deployments running untrusted code in sandboxed environments such as Java Web Start applications or applets. Server-side Java deployments running only trusted code are not affected. The vulnerability has a high CVSS score of 8.1, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its July 2025 Critical Patch Update, which contains multiple security patches across Oracle products.