CVE-2026-91418 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX: 21.0.12, 25.0.4, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the ImageIO component of Oracle Java SE, Oracle JavaFX, and associated GraalVM distributions, affecting a wide range of supported versions including Java SE 8 through 27, Java FX 21 through 27, and specific releases of GraalVM for JDK and Enterprise Edition. This flaw represents a significant availability risk because it allows an unauthenticated attacker with network access to exploit the vulnerability via multiple protocols. The core technical issue stems from improper handling of input data within the ImageIO library, which is responsible for loading and processing image files in various formats such as JPEG, PNG, GIF, BMP, and TIFF. When maliciously crafted or malformed image data is processed by this component, it triggers a condition that leads to resource exhaustion or infinite loops, ultimately causing the Java Virtual Machine process to become unresponsive or crash. This behavior classifies the vulnerability primarily under CWE-400, which describes Uncontrolled Resource Consumption, as the attacker can force the application to consume excessive CPU cycles or memory without bound.
The operational impact of this vulnerability is characterized by a partial denial of service against the affected Oracle Java SE, JavaFX, and GraalVM environments. Because the exploit requires no authentication and can be triggered remotely over network protocols, it poses a severe threat to any server-side application that processes user-uploaded images or interacts with external image sources using these libraries. For client-side deployments, particularly those utilizing sandboxed Java Web Start applications or applets that load untrusted code from the internet, the risk is equally critical as the Java security model relies on the integrity of its underlying components to maintain isolation boundaries. If the ImageIO component fails due to this vulnerability, it can break the execution context, potentially leading to application crashes that disrupt service availability for end-users. The CVSS 3.1 base score of 5.3 reflects a medium severity level with an emphasis on availability impacts, indicating that while confidentiality and integrity are not directly compromised in all scenarios, the disruption to system uptime is significant enough to warrant immediate attention.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1496, Resource Hijacking, where adversaries use computing resources for their own purposes or cause denial of service by exhausting system resources. The attack vector allows exploitation through APIs in the specified component, meaning that any web service or application interface that accepts image data and passes it to ImageIO functions is a potential entry point. Attackers can craft specific image files containing malformed headers, excessive metadata, or deeply nested structures designed to trigger internal parsing errors or infinite recursion within the decoder logic. This exploitation path does not require user interaction beyond the initial submission of the malicious payload if processed automatically by backend services, making it particularly dangerous for automated pipelines that ingest images from untrusted sources such as social media platforms, file upload portals, or IoT device feeds.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to apply the latest security updates provided by Oracle for all affected versions of Java SE, Java FX, and GraalVM. Organizations should prioritize updating servers that expose image processing capabilities over public networks or untrusted internal segments. In addition to patching, defensive measures include implementing strict input validation and sanitization at the application layer before data reaches the ImageIO component. This involves verifying file signatures against declared MIME types, limiting maximum dimensions of processed images, and enforcing size limits on uploaded files to prevent resource exhaustion attacks. Furthermore, deploying these applications within containerized environments with CPU and memory quotas can help contain the impact of a successful denial-of-service attempt, ensuring that one compromised process does not degrade the performance of the entire host system. Regular security assessments should also include fuzzing tests targeting image parsing libraries to detect similar vulnerabilities in other components before they are exploited in the wild.