Oracle Java SE CVE-2026-91382

Exploitation requires the vulnerable Java 2D component to receive attacker-controlled input - specifically an application, web service, or API that feeds untrusted data to the 2D APIs, or a client running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code and rely on the Java sandbox. No authentication is required (PR:N) and no user interaction is needed (UI:N). The principal limiting factor is high attack complexity (AC:H): Oracle explicitly labels this 'difficult to exploit,' meaning success depends on conditions the attacker cannot directly control. Server-side risk is confined to deployments that actually route untrusted data into the 2D APIs; the sandboxed applet/Web Start client vector is increasingly rare in modern environments as browser plugin support has been removed.

This is a moderate-risk issue that should be patched on a normal cycle rather than treated as an emergency. The CVSS 3.1 score of 6.5 is driven by high integrity impact (I:H) and partial availability impact (A:L), with no confidentiality impact (C:N). The key mitigating signal is attack complexity: AV:N/PR:N/UI:N means a remote, unauthenticated attacker with no user interaction, but AC:H (high complexity) indicates the attack depends on conditions outside the attacker's control and is described by Oracle as 'difficult to exploit.' No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent (network vector matches the 'via multiple protocols' and 'web service which supplies data to the APIs' language), so no major conflict exists. The practical tension is between a ubiquitous product footprint (Java SE/GraalVM) and a high-complexity, impact-limited flaw: broad reach but hard-to-weaponize. Absent EPSS/KEV/POC data, treat this as a standard high-priority patch within the Oracle October 2026 CPU, not an out-of-band fire drill.

A remote, unauthenticated attacker supplies specially crafted data to an application that passes it to the Java 2D component - for example through a web service or API that processes attacker-controlled image or rendering input. If the difficult-to-satisfy preconditions are met, the attacker corrupts or modifies critical data and can induce a partial denial of service. No public exploit code is identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.