Oracle Java SE CVE-2026-71054

Exploitation requires that the target system is running Oracle Java SE 7u511 specifically. Two distinct exploitation paths exist: the server-side path requires a network-accessible service or application that invokes 2D component APIs with attacker-controlled input (e.g., an image processing or document rendering web service); the client-side path applies to Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet, relying on the Java sandbox for security. The latter client-side path requires user interaction to load the malicious content, which the CVSS UI:N metric does not appear to reflect for that scenario - a potential inconsistency worth flagging. No authentication is required per the CVSS PR:N metric. Exploitation is limited to Java SE 7u511 only; organizations running Java 8, 11, 17, or 21 are not affected by this specific CVE.

The CVSS 3.1 base score of 6.5 is derived from a medium availability and integrity impact combination (A:L/I:L) rather than a full availability-only score, yet the advisory text describes the outcome as a 'complete DOS' and 'hang or frequently repeatable crash' - language that typically aligns with A:H. This discrepancy between the vendor narrative ('Availability impacts') and the CVSS vector (which also includes I:L with no explanation) should be verified directly against the full Oracle Critical Patch Update advisory at the referenced support document. No EPSS data was supplied in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not in the CISA KEV catalog and no public exploit code is known, indicating limited active threat actor interest at present. The AC:L/PR:N combination means exploitation is automatable and requires no special setup, raising concern for any organization that exposes Java 7 web-service APIs externally; however, the constrained impact (DoS rather than code execution) reduces attacker motivation substantially. Java 7 extended support deployments are a shrinking population, limiting aggregate exposure compared to vulnerabilities in current LTS releases.

A remote attacker sends a specially crafted request to a publicly accessible web service that passes data to Oracle Java SE's 2D rendering APIs - for example, a document conversion or image processing endpoint - causing the JVM to enter an unrecoverable hang or crash loop. Alternatively, an attacker hosts a malicious Java Web Start application or applet and entices a user running Java 7 to load it, triggering the same crash within the sandboxed client environment. No public proof-of-concept code has been identified, but the low attack complexity (AC:L, PR:N, UI:N) means developing an exploit requires only knowledge of the vulnerable API surface.