CVE-2026-91382 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the 2D component of Oracle Java SE, as well as Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition versions including 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 21.3.19.1.1. This flaw represents a significant security risk because it allows an unauthenticated attacker to compromise the integrity of critical data or cause partial denial of service conditions through network-accessible protocols. The vulnerability is classified as difficult to exploit due to high complexity requirements for successful exploitation, yet its impact on system integrity and availability remains substantial enough to warrant immediate attention from security operations teams managing these Java environments.
From a technical perspective, the root cause lies in how the 2D graphics processing subsystem handles specific inputs when invoked via application programming interfaces. Attackers can leverage this weakness by supplying maliciously crafted data through web services or other network protocols that interface with these APIs. The flaw does not require user interaction to trigger, meaning it is exploitable without any UI involvement from a victim. This characteristic significantly lowers the barrier for automated attacks where scripts can repeatedly attempt to exploit the condition against exposed endpoints. The vulnerability affects both server-side deployments and client-side environments running sandboxed Java Web Start applications or applets that load untrusted code from external sources, relying on the standard Java security model which is bypassed by this specific flaw in the 2D rendering engine.
The operational impact of a successful exploitation centers heavily on data integrity and system availability rather than confidentiality. An attacker who successfully exploits this vulnerability gains the ability to create, delete, or modify critical data accessible to the compromised application. This aligns with CWE-354 Improper Validation of Integrity during Processing, as the internal state management within the 2D component fails to properly validate inputs before applying changes to memory structures or persistent storage. Furthermore, the potential for causing a partial denial of service indicates that malformed input can lead to resource exhaustion or application crashes, corresponding to CWE-400 Uncontrolled Resource Consumption. This dual impact means organizations face risks ranging from data corruption and loss to service disruption affecting end-users who depend on these Java-based applications.
In terms of threat modeling and industry standards, this vulnerability maps closely to MITRE ATT&CK techniques involving remote code execution or system configuration modification via network services. Specifically, it relates to the exploitation of application layer protocols where an attacker sends crafted requests that trigger unintended behavior in the target software. The high complexity requirement suggests that while automated scanning tools might detect the presence of vulnerable versions, successful manual exploitation requires precise crafting of payloads tailored to specific internal states or race conditions within the 2D graphics pipeline. This makes it less susceptible to widespread worm-like propagation but still dangerous against targeted attacks where attackers have some knowledge of the target environment's configuration and data structures.
Mitigation strategies must prioritize immediate patching for all affected versions listed, including Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Organizations should verify their inventory of Java deployments, paying special attention to legacy systems running sandboxed applets or Web Start applications that interact with external data sources. For environments where patching is not immediately feasible, network-level controls such as web application firewalls can be configured to inspect and block suspicious traffic patterns targeting the 2D APIs. Additionally, restricting access to these services from untrusted networks reduces the attack surface significantly. Security teams should also monitor for indicators of compromise related to unusual resource consumption or data modification events that could signal an attempted exploitation of this vulnerability in real time.