Cloudanix VulnDB

CVE-2026-91334

Low · 3.7

CVSS

3.7

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Java software could let someone see small pieces of private information if they send specially crafted requests, but it is very hard to pull off.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw in the ImageIO component allows an unauthenticated network attacker to read a limited subset of accessible data by supplying crafted inputs to image processing APIs, including via web services or untrusted sandboxed code.

Why it matters to the business

Limited risk of partial data exposure in Java-based applications and services; low exploitation probability, stable low EPSS, and absence from KEV mean minimal operational urgency despite recent publication.

How an attack unfolds

An attacker with network access identifies a reachable Oracle Java SE or GraalVM deployment and supplies malicious data to ImageIO APIs over multiple protocols or via untrusted code loaded in sandboxed Java Web Start or applets, resulting in unauthorized reads of a data subset. High attack complexity and no known threat actors or ransomware use reduce likelihood.

How to fix it

Apply the latest Oracle Critical Patch Update that addresses this issue in Java SE, GraalVM for JDK, and GraalVM Enterprise Edition; upgrade from the listed affected versions as patches become available.

How to confirm the fix worked

Confirm deployed Java versions are no longer in the affected range (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, etc.) and test that ImageIO APIs reject or safely handle malformed inputs without leaking data.

Typical attack path

  1. Locate a network-accessible Java deployment exposing ImageIO component
  2. Craft and send malicious input via supported protocols or untrusted code path
  3. Trigger ImageIO processing to induce partial data disclosure
  4. Capture leaked information from API responses or side effects

How to detect it

Examine application and web server logs for anomalous ImageIO processing, unexpected API calls returning partial data, or errors from untrusted code paths; correlate with network traffic to Java endpoints.

What your security team should do

  • Include this update in the next scheduled Oracle CPU deployment
  • Inventory Java runtimes and GraalVM instances for exposure to untrusted inputs
  • Restrict network access to ImageIO-dependent services where feasible

The record

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities