CVE-2026-91400 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Sound component of Oracle Java SE, as well as Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition products. This security flaw affects a specific range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, alongside specific releases of Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, as well as Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The core nature of this vulnerability is characterized by its difficulty to exploit, which serves as a significant mitigating factor against widespread automated attacks. It allows an unauthenticated attacker with network access via multiple protocols to compromise the affected Java environments. However, successful exploitation is contingent upon human interaction from a user other than the attacker, indicating that social engineering or specific user actions are required to trigger the flaw.
The operational impact of this vulnerability centers on availability rather than confidentiality or integrity. A successful attack results in an unauthorized ability to cause a partial denial of service against the Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition platforms. This means that while the system may not be completely taken offline, its performance or functionality is degraded, potentially disrupting services that rely on these Java deployments. The CVSS 3.1 Base Score reflects this limited impact with a score of 3.1, categorized under Availability impacts. The specific vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) confirms that the attack requires high complexity and user interaction but has no prerequisites for authentication and affects only availability with low impact severity.
Contextually, this vulnerability applies primarily to Java deployments in client-side scenarios where sandboxed applications are utilized. This includes clients running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code originating from the internet. These environments rely heavily on the Java security manager and sandboxing mechanisms for protection. The flaw exploits weaknesses within these boundaries when handling sound-related operations, potentially leading to resource exhaustion or state corruption in the audio subsystem. It is crucial to note that this vulnerability does not apply to server-side Java deployments where only trusted code, such as applications installed by an administrator from internal sources, is loaded and executed. In those contexts, the risk profile is significantly lower due to the absence of untrusted external inputs.
From a classification perspective, this issue aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically leading to denial of service conditions. The requirement for human interaction places it within the realm of social engineering vectors often associated with ATT&CK technique T1566, Phishing, although the technical exploit itself is a code execution or resource exhaustion flaw rather than purely phishing-based. Attackers may leverage this by crafting malicious audio files or streams that trigger the vulnerability when processed by vulnerable Java components in web browsers or standalone applications.
Mitigation strategies should focus on immediate patching of all affected versions to Oracle's latest security updates, which address the underlying code defects in the Sound component. For organizations relying on legacy systems where patching is not immediately feasible, network-level controls such as firewalls and intrusion prevention systems can be configured to block traffic containing suspicious audio payloads or restrict access to Java-enabled endpoints from untrusted networks. Additionally, disabling Java applets and Web Start applications in web browsers reduces the attack surface significantly since these are primary vectors for client-side exploitation. Security administrators should also enforce strict code signing policies and ensure that only trusted sources are allowed to execute Java applications within their environments, thereby minimizing exposure to untrusted code that could trigger this vulnerability. Regular audits of deployed Java versions across the enterprise infrastructure are essential to identify any remaining vulnerable instances before they can be targeted by sophisticated attackers who may eventually develop more reliable exploitation methods for this high-complexity flaw.