The vulnerability in Oracle JavaFX allows an unauthenticated attacker with network access to compromise sandboxed Java deployments and read a subset of data. The flaw requires human interaction beyond the attacker to trigger, and the resulting impact is limited to confidentiality, with a CVSS base score of 3.1. Accessing Java Web Start applications or applets that load untrusted code can expose sensitive information while the sandbox is supposed to prevent it.

Oracle JavaFX versions 25.0.4 and 27 are affected. The issue applies to client environments that run sandboxed Java Web Start applications or applets that import code from the internet. Server deployments that exclusively use trusted code are not impacted.

The CVSS score of 3.1 reflects a low impact, and the EPSS score of < 1% indicates limited public exploit activity. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network reach to the impacted JavaFX instance and a user to interact with it, making exploitation more difficult. The attack vector is likely network-based, but user involvement is required for the read exploit to succeed.