Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Partial Denial of Service
Action: Patch
AI Analysis

Impact

A flaw in the Sound component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access to trigger a partial denial of service. The vulnerability requires the victim to interact with untrusted code, such as a sandboxed Java Web Start application or applet, and does not compromise confidentiality or integrity. It is classified as a low‑severity Availability weakness and a low‑severity Resource Exhaustion weakness (CWE‑400).

Affected Systems

Affected products include Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK, and Oracle Java SE from Oracle Corporation. Vulnerable versions are Java 8u503, 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; and GraalVM Enterprise Edition 21.3.19.1.1. The issue specifically impacts clients that load and execute untrusted code in a sandboxed environment and does not affect server deployments that run only trusted code.

Risk and Exploitability

The CVSS v3.1 base score is 3.1, with attack vector network, high complexity, no privileges granted, requiring user interaction and an unavailable local availability impact. EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The exploitable path is not trivial but is achievable with an untrusted payload that a user must run, so the risk is moderate for client deployments. No remote code execution is possible, and the primary concern remains partial service disruption.

Generated by OpenCVE AI on October 29, 2026 at 20:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition patch that addresses the Sound component vulnerability.
  • Eliminate or disable Java Web Start and applet support, or enforce strict code signing policies to prevent loading of untrusted code.
  • Restrict network exposure of the affected Java runtime by using firewall rules or network segmentation to block external access that could supply the malicious payload.

Generated by OpenCVE AI on October 29, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4861-1 openjdk-17 security update
Ubuntu USN Ubuntu USN USN-9009-1 OpenJDK 8 vulnerabilities
Ubuntu USN Ubuntu USN USN-9010-1 OpenJDK 11 vulnerabilities
Ubuntu USN Ubuntu USN USN-9014-1 OpenJDK 17 vulnerabilities
Ubuntu USN Ubuntu USN USN-9015-1 OpenJDK 21 vulnerabilities
History

Thu, 29 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Oracle oracle Java Se
Vendors & Products Oracle graalvm Enterprise Edition
Oracle oracle Java Se

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-388

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Partial DoS via Untrusted Java Sound Component openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 21 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title Partial DoS via Untrusted Java Sound Component
Weaknesses CWE-388

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
Oracle java Se
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T12:09:28.628Z

Reserved: 2026-09-14T22:10:16.632Z

Link: CVE-2026-91400

cve-icon Vulnrichment

Updated: 2026-10-23T19:49:34.841Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:43.440

Modified: 2026-10-29T13:17:15.360

Link: CVE-2026-91400

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T21:25:46Z

Links: CVE-2026-91400 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T20:45:14Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling