A flaw in the JDK tools component of Oracle Java SE and GraalVM products permits a local, unauthenticated user who has logged into a host machine to modify critical data when prompted to interact with sandboxed Java Web Start or applet content. The vulnerability arises from a use‑after‑free condition (CWE‑416, CWE‑653) that allows the attacker to create, delete, or alter files and resources accessible by the vulnerable Java runtime, thereby compromising data integrity. Because the flaw does not grant remote code execution or confidentiality leakage, its primary risk is data modification rather than broader system compromise.

The issue impacts Oracle Java SE versions 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1.1.

The CVSS 3.1 base score of 4.7 reflects moderate severity, originating from local access with high attack complexity and a requirement for user interaction. The EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalogue, suggesting limited current exploitation activity. Nonetheless, any attacker who can obtain local log‑on credentials and co‑operate with a human user has the opportunity to alter data within the vulnerable Java environment, potentially undermining application integrity. Based on the description and CVSS vector, it is inferred that the attack requires a local user with log‑on credentials and a willingness to interact with the compromised application.