Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Patch Now
AI Analysis

Impact

A read‑only vulnerability exists in the ImageIO component of Oracle Java SE and GraalVM products that allows an unauthenticated attacker with network access to read a restricted subset of data through exposed APIs. The flaw is triggered by the use of ImageIO functions within web services, remote API calls, or sandboxed Java Web Start applications that load and execute code from untrusted sources. Successful exploitation does not grant code execution or modify data, but it does disclose confidential information that should otherwise be protected by application or sandbox controls.

Affected Systems

Oracle vendors affected include Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affected releases are Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1.

Risk and Exploitability

The CVSS v3.1 base score of 3.7 indicates a low overall severity but a confidentiality impact. The EPSS score of less than 1% reflects a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active attacks at the time of analysis. Because the flaw can be triggered remotely without authentication through standard network protocols, an attacker who successfully exploits it can read protected data that resides within the application’s file system or memory. Consequently, organizations should treat this as a low‑severity but real risk for data exposure, especially in environments that expose ImageIO functionality to untrusted inputs.

Generated by OpenCVE AI on October 22, 2026 at 15:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade all Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition installations to the latest patched releases (e.g., Java SE 8u504 or newer, 11.0.32.2 or newer, 17.0.20.2 or newer, 21.0.12.2 or newer, 25.0.5 or newer, 27.1 or later, and GraalVM 21.3.19.2 or newer).
  • If ImageIO functionality is not necessary, remove or disable the ImageIO module or restrict its API usage via security manager policies to prevent unintended file read access.
  • Ensure that applications which load untrusted or external code—such as Java Web Start, sandboxed applets, or any service exposing ImageIO APIs—are configured with the most recent sandbox settings and do not expose internal ImageIO functionality to external callers.

Generated by OpenCVE AI on October 22, 2026 at 15:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read via ImageIO APIs in Oracle Java SE and GraalVM openjdk: Enhance JPEG loading (Oracle CPU 2026-10)
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Read via ImageIO APIs in Oracle Java SE and GraalVM
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T17:53:52.517Z

Reserved: 2026-09-14T22:10:16.628Z

Link: CVE-2026-91334

cve-icon Vulnrichment

Updated: 2026-10-28T17:53:46.905Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:35.630

Modified: 2026-10-28T18:17:22.283

Link: CVE-2026-91334

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T21:25:22Z

Links: CVE-2026-91334 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:45:04Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control