Oracle Java SE CVE-2026-70906

Exploitation requires that the target runs Oracle Java SE version 25.0.4 or 26.0.2 specifically - other version lines are not listed as affected. For server-side exploitation, the Java application must expose a network-accessible interface (web service, API endpoint, or similar) that accepts attacker-controlled data and passes it to the 2D component's APIs, such as image decoding, graphics processing, or font rendering routines. For client-side exploitation, the Java runtime must be configured to run Java Web Start applications or Java applets that load untrusted code from the internet while relying on the Java sandbox for security isolation - a configuration largely deprecated and disabled in modern browser and OS environments, which significantly limits this attack path in practice. Limiting factors include: the narrow affected version range (only the two most recent Java SE point releases at advisory time), the requirement for an exposed 2D-processing API in server deployments, the practical rarity of active Java Web Start or applet usage in client deployments, and the purely availability-focused impact with no confidentiality or integrity consequences.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H presents a clear high-severity availability threat: fully unauthenticated, network-reachable, low attack complexity, and requiring no user interaction. Oracle's own characterization of 'easily exploitable' reinforces the AC:L/PR:N reading. The sole impact is complete denial of service - confidentiality and integrity are unaffected - which reduces business criticality for some threat models but makes this a priority for uptime-sensitive Java services. EPSS data was not available in the provided intelligence, so exploitation probability cannot be quantified with that signal. No KEV listing exists and no public exploit code has been identified, which suggests opportunistic mass exploitation is not yet occurring; however, Oracle CPU disclosures historically attract rapid reverse-engineering, narrowing that window. The dual attack surface - server APIs and sandbox-dependent client deployments - means even a mid-sized municipal IT team in inowroclaw running a Java-based document or image processing service faces real risk within their normal update cycle. The version specificity (only 25.0.4 and 26.0.2, representing very recent Java SE releases) limits exposure to organizations on the leading-edge update track.

An unauthenticated remote attacker sends a crafted network request containing a malformed image or graphics payload to a Java-based web service that internally passes the data to the 2D component's APIs - for example, an image conversion or document rendering endpoint. The malformed input triggers an unhandled condition in the 2D subsystem causing the JVM process to hang indefinitely or crash, taking the service offline. No public exploit code has been identified at time of analysis, though Oracle's 'easily exploitable' characterization suggests the trigger condition is not complex to reproduce.