CVE-2026-91382

What it actually does

The flaw permits an unauthenticated remote attacker to supply crafted input to the 2D component APIs, resulting in unauthorized modification, deletion, or creation of critical data and a partial denial of service.

Why it matters to the business

Organizations running affected Java deployments face risk of data tampering and service disruption that could affect application integrity and availability, with urgency driven by the four-day-old disclosure and broad downstream usage of Java runtimes.

How an attack unfolds

An attacker identifies a reachable Java 2D API endpoint or sandboxed client that processes untrusted data, crafts a malicious payload that triggers improper input handling, and sends it over the network; successful exploitation grants the ability to alter or destroy accessible data and partially impair the process without authentication.

How to fix it

Apply the latest vendor patches for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition as soon as they become available; restrict exposure of 2D APIs to untrusted callers and enforce strict input validation on any custom data-processing paths until updates are deployed.

How to confirm the fix worked

Confirm that running Java instances report versions newer than the affected releases, review application logs and API call patterns for anomalous 2D processing behavior, and re-test any custom code paths that invoke the 2D component with previously problematic inputs.

Typical attack path

1. Locate a network-accessible service or client using the vulnerable Java 2D component
2. Craft input that bypasses validation in the 2D processing path
3. Deliver the payload via supported protocols or untrusted code loaded by the sandbox
4. Trigger data modification or partial service degradation

How to detect it

Review application and Java runtime logs for unexpected errors or partial failures during 2D image or graphics operations; look for network traffic or API calls carrying unusually large or malformed data to 2D processing endpoints.

What your security team should do

• Prioritize inventory of all Java 8, 11, 17, and 21 deployments and schedule immediate patching once fixes are released
• Reduce attack surface by disabling or sandboxing 2D API exposure where feasible
• Monitor EPSS and KEV status for changes that would elevate urgency