CVE-2026-91381 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the 2D component of Oracle Java SE and Oracle GraalVM Enterprise Edition, specifically affecting versions such as Oracle Java SE 8u503, 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. This flaw is classified under the category of integrity violations where an attacker can manipulate data accessible to the application without necessarily achieving full system compromise or denial of service. The vulnerability stems from a logic error or improper validation within the rendering engine responsible for handling two-dimensional graphics operations, which are frequently invoked by high-level APIs used in enterprise applications and web services.
Exploitation of this flaw requires an unauthenticated attacker with network access via multiple protocols to interact with the affected Java components. While the attack complexity is rated as difficult due to specific conditions required for successful exploitation, the lack of authentication requirements significantly lowers the barrier to entry compared to vulnerabilities requiring user interaction or prior credentials. The primary vector involves supplying maliciously crafted data through APIs that feed into the 2D rendering subsystems. This often occurs in scenarios where Java applications consume external data sources, such as web services providing graphical assets or configuration parameters that are processed by the graphics pipeline before being rendered or stored.
The operational impact of a successful exploit centers on unauthorized modifications to accessible data within the Oracle Java SE environment. Specifically, an attacker can perform unauthorized updates, inserts, or deletes against data managed by the application. This represents a direct breach of data integrity, potentially leading to corrupted states in applications that rely on accurate graphical rendering for business logic or user interface consistency. In environments where Java applets or Web Start applications are deployed, particularly those running within sandboxed contexts and loading untrusted code from the internet, this vulnerability undermines the security model by allowing external inputs to alter internal data structures beyond their intended scope.
From a threat intelligence perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-354 Improper Validation of Integrity Check Value within the Common Weakness Enumeration framework. The attack pattern corresponds to ATT&CK technique T1059 Command and Scripting Interpreter if interpreted through API abuse, or more accurately T1113 Screen Capture for data exfiltration contexts, though here it is primarily focused on data manipulation (T1565 Data Manipulation). The CVSS 3.1 base score of 3.7 reflects the low impact on confidentiality and availability but highlights the integrity risk with a local scope where no privilege escalation or user interface interaction is required for network-based attacks.
Mitigation strategies must prioritize immediate patching to the latest available versions of Oracle Java SE and GraalVM Enterprise Edition that address this specific flaw in the 2D component. Organizations should also implement strict input validation at the application layer, ensuring that any data passed to graphics APIs undergoes rigorous sanitization before processing. Network segmentation can help limit exposure by restricting access to systems running vulnerable Java versions from untrusted networks. Additionally, deploying Web Application Firewalls with rules capable of detecting anomalous patterns in API requests targeting graphical rendering endpoints may provide an additional layer of defense against exploitation attempts leveraging this integrity vulnerability.