The vulnerability is in the libpng library used by OpenJDK, associated with CWE-787 indicating a buffer overflow that may allow memory corruption. The official description is not available, but the weakness type suggests that corrupt writes could lead to arbitrary code execution or data tampering. The primary impact from a security standpoint is the potential compromise of confidentiality or integrity of memory used by affected processes.

Affected systems include OpenJDK installations that incorporate the libpng library, particularly those maintained by Oracle and other vendors following the Oracle CPU April 2026 advisories. Specific version information is not provided, so any OpenJDK build using the vulnerable libpng implementation is potentially impacted.

The CVSS score of 7.1 reflects high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Though the official attack vector is not defined, the nature of a buffer overflow in an image parsing library infers that an attacker could supply a crafted PNG file to trigger the overflow. This could result in arbitrary code execution or process termination. Because no workaround is listed, the recommendation is to apply the vendor patch where available.