The vulnerability resides in the Java plugin component of Oracle Java SE and allows a low-privileged local attacker who can log on to the system that runs Java to escape the sandbox and gain elevated privileges within the Java environment. Successful exploitation enables the attacker to create, delete, or modify critical data that the Java plugin can access, thereby compromising confidentiality and integrity for any resources exposed through that environment. The CVSS vector indicates a change in scope, meaning the attacker may affect resources beyond the original user context.

The affected products are Oracle Java SE 8u503 and the 8u503-perf performance build. These versions are typically found in client deployments that execute sandboxed Java WebStart applications or applets, loading untrusted code from the Internet. Server deployments that run only trusted, administrator-installed code are not impacted.

The CVSS score of 7.5 reflects substantial confidentiality and integrity impact under a high-attack-complexity scenario. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation. The local nature combined with high attack complexity means an attacker must have console access and the ability to run untrusted Java applications on the host. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires that the attacker be able to run Java applications with untrusted code on the target system; no network interface is needed, and the vulnerability is not directly exploitable from outside the host.