Oracle Java SE CVE-2026-91418

Exploitation requires that an affected JVM (Oracle Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX 21.0.12/25.0.4/27; Oracle GraalVM for JDK 17.0.20.1/21.0.12.1; Oracle GraalVM EE 21.3.19.1.1) actually feed attacker-controlled image data into the ImageIO component - e.g., a web service or API endpoint that decodes uploaded/remote images, or a sandboxed Java Web Start app or applet loading untrusted code. The vulnerability is unauthenticated (PR:N) and needs no user interaction (UI:N), but is LIMITED to availability (partial DoS only, no data compromise) and is only reachable where the ImageIO APIs process untrusted input; server-side JVMs that never parse untrusted images are not exposed, and the applet/Web Start vector is largely deprecated in modern deployments.

All available signals point to a low-to-moderate, availability-only issue rather than a high-priority emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 MEDIUM) describes a network-reachable, low-complexity, unauthenticated flaw with NO confidentiality or integrity impact and only PARTIAL availability impact - consistent with a resource-exhaustion or crash condition in the ImageIO image-parsing component, not remote code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The one genuine tension to flag: the CVSS vector says AV:N/PR:N (remotely reachable, unauthenticated), but the description's reach depends on whether an application actually exposes the vulnerable ImageIO APIs to untrusted input (e.g., a web service that parses attacker-supplied images) or runs untrusted sandboxed code - a server-side JVM that never processes untrusted images is not meaningfully exposed. Net judgment: a real but modest patch-in-normal-cycle issue, not a drop-everything priority; the MEDIUM score is not inflated, and the absence of KEV/POC/EPSS signals reinforces lower operational urgency.

An attacker submits a specially crafted image file to an application that passes untrusted input through the vulnerable Java ImageIO parsing APIs - for example, an upload/thumbnail endpoint of a web service backed by an affected JVM. Parsing the malformed image triggers excessive resource consumption or an unhandled condition that degrades or crashes the processing thread/service, causing a partial denial of service. No public exploit code or active exploitation is identified in the provided data.