Oracle Java SE CVE-2026-91400

Exploitation requires a client-side Java deployment that loads and runs untrusted code through the sandboxed Java Web Start or Java applet model, per Oracle's explicit scoping note; server deployments executing only administrator-installed trusted code are NOT affected. The attack further requires human interaction from a victim other than the attacker (UI:R) - the user must be induced to load/run the malicious untrusted application - and is rated high-complexity (AC:H), meaning conditions beyond the attacker's control must be met. These limiting factors (deprecated applet/Web Start surface, mandatory user interaction, high complexity) substantially narrow realistic exploitation. The only achievable outcome is a partial denial of service; there is no confidentiality or integrity impact.

This is a genuinely low-priority issue despite affecting a ubiquitous product. The CVSS 3.1 base score is 3.1 (Low), and the vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) tells a consistent story: although network-reachable and unauthenticated, exploitation is rated high-complexity (AC:H) and requires user interaction (UI:R), with the only outcome being a partial denial of service (A:L) and no confidentiality or integrity impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced - there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Critically, Oracle explicitly limits impact to client-side Java deployments that run untrusted code via the now-deprecated Java Web Start / applet sandbox model; server deployments running only trusted code are not affected. The signals are mutually reinforcing rather than conflicting: low severity, high attack complexity, user interaction required, DoS-only, and a shrinking real-world attack surface all point to a patch-in-normal-cycle issue, not an emergency.

An attacker hosts a malicious website or Java Web Start application containing a crafted audio/Sound-processing payload. A victim running a vulnerable Java client is lured into loading and executing the untrusted sandboxed applet or Web Start app, and the malformed Sound data triggers a partial denial of service in the Java runtime. No public exploit code is identified at time of analysis, and the high attack complexity plus required user interaction make reliable exploitation difficult.