A low‑privileged attacker who has local logon access to the infrastructure where Oracle Java SE or Oracle GraalVM Enterprise Edition runs can exploit a Hotspot component weakness to execute actions that modify, delete, or create critical data and to cause the application to hang or crash repeatedly. The vulnerability does not allow complete remote control of the system, but it does break data integrity and availability for the affected product.

Oracle Java SE versions 8u481 and 8u481‑b50, and Oracle GraalVM Enterprise Edition version 21.3.17, are impacted. The issue is relevant mainly to sandboxed client deployments such as Java Web Start applications or applets that load untrusted code from the internet; it does not affect server deployments that run only trusted, administrator‑installed code.

The CVSS 3.1 base score is 6.0 with attack vector local, high complexity, low privilege, required user interaction, and an unmodified scope. The EPSS score is not available and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires a human user interacting with the affected application outside of the attacker’s direct control, so automated attacks are unlikely, yet environments that allow untrusted Java clients remain at risk.