Oracle Java SE CVE-2026-91334

Exploitation requires the target to process attacker-controlled image data through the JDK's ImageIO APIs - e.g., a web service or application that accepts and decodes untrusted images - or a victim running a sandboxed Java Web Start application or applet that loads untrusted code from the internet and relies on the Java sandbox. Limiting factors: HIGH attack complexity (AC:H) means exploitation is difficult and condition-dependent; impact is confined to LOW confidentiality (partial read access) with no integrity or availability effect; and server-side risk only materializes where untrusted input actually reaches ImageIO. The applet/Web Start vector is further limited by the declining deployment of browser-based Java plugins.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score is only 3.7 (LOW), driven by the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N: network attack vector and no privileges/UI required, but HIGH attack complexity (AC:H) and only a LOW confidentiality impact (C:L) with no integrity or availability impact. Oracle's own text characterizes it as 'difficult to exploit' and limited to 'unauthorized read access to a subset of accessible data,' which is consistent with C:L/I:N/A:N. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence, so this reflects no public exploit identified at time of analysis. The combination of high attack complexity, partial confidentiality-only impact, and absence of any exploitation signal means the real-world risk is well below what 'network/unauthenticated' alone might suggest - this is a high-CVSS-attack-surface-but-low-real-impact issue, not an urgent fire. Note two data conflicts to verify: (1) the input Tag 'Authentication Bypass' contradicts the description, which describes an information-disclosure (read access) flaw, not an authentication bypass; (2) CWE is N/A, so the precise weakness class is unconfirmed. EPSS and POC data are absent rather than confirmed-negative.

A remote, unauthenticated attacker supplies a maliciously crafted image to a service that passes untrusted input to the JDK's ImageIO APIs (for example, an image-processing web service or upload handler), or lures a user running a sandboxed Java Web Start app or applet into loading attacker-controlled content. Due to the HIGH attack complexity (AC:H), successful exploitation requires specific conditions and is difficult to achieve reliably; a successful attempt yields only limited unauthorized read access to a subset of data. No public exploit code was identified at time of analysis.