This vulnerability permits an unauthenticated attacker with network access to exploit a sandboxed Oracle Java deployment that has loaded untrusted code. The flaw provides the attacker with unauthorized read access to a subset of data that the application can normally reach, without granting any further privileges. Its impact is limited to confidentiality and is captured by a low CVSS base score of 3.1.

Affecting Oracle’s GraalVM Enterprise Edition 21.3.19.1.1, Oracle Java SE version 8u503, and Oracle JavaFX versions 21.0.12, 25.0.4, and 27, the flaw is relevant only to sandboxed Java Web Start applications or Java applets that fetch code from untrusted external sources.

The CVSS score of 3.1 indicates a low overall risk, and the EPSS score of less than 1% suggests the likelihood of successful exploitation is very small. The vulnerability is not listed in the CISA KEV catalog. Successful attacks require the attacker to deliver a crafted payload over one of several protocols and then rely on a user, other than the attacker, to interact with the Java application that loads the malicious code. Because the attack hinges on user action and provides only partial read access, the threat remains modest, yet it still warrants remediation to safeguard confidential data.