The flaw is a cross‑site scripting weakness located within JavaFX, an out‑of‑box component of Oracle Java SE. An attacker can embed malicious code into a Java Web Start or applet image that, when executed by a victim, permits the attacker to update, insert or delete data that the Java runtime can access. Although the attack does not grant arbitrary code execution, it violates the integrity of client‑side data exposed by the Java application.

The vulnerability affects Oracle Java SE 8u471‑b50, specifically the JavaFX component included in the JDK and JRE distributions. Client environments that run sandboxed Java Web Start applications or applets which load untrusted code from the internet are at risk. Deployments that use Java in server‑only trusted contexts are not impacted.

The CVSS base score of 3.1 classifies the flaw as Low, and the EPSS score of less than 1 % indicates a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, supporting its low exploitability. Exploitation requires an attacker to deliver malicious JavaFX content to a client and persuade a user to open it; even then the impact is limited to integrity violations rather than remote code execution.