Oracle Java SE EUVD-2026-24303

Exploitation requires all of the following conditions simultaneously: the target must be running Oracle Java SE 8u481 or 8u481-b50, or GraalVM Enterprise Edition 21.3.17 (later or earlier versions are not confirmed affected); the deployment must be a client-side sandboxed environment actively executing Java Web Start applications or sandboxed Java applets that load untrusted code sourced from the internet - server-side deployments running only administrator-installed trusted code are explicitly out of scope per the vendor description; the attacker must hold a local logon session on the same infrastructure (AV:L, PR:L - unauthenticated remote exploitation is not possible); a separate human user other than the attacker must actively interact with the malicious content (UI:R); and high attack complexity (AC:H) means that specific, not easily reproducible conditions within the Hotspot execution environment must align. Limiting factors include the obsolescence of Java Web Start in modern Java versions (removed in Java 11+), the absence of browser Java plugin support across all major browsers, and the need for both local access and social engineering of a third party.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H scores 6.0 (Medium) and accurately reflects a constrained attack: local access required, high complexity, low privileges, and mandatory third-party human interaction, with zero confidentiality exposure. All secondary signals reinforce a low real-world priority: EPSS at 0.01% places this in the 2nd percentile of exploitation likelihood; SSVC signals Exploitation=none, Automatable=no, and Technical Impact=partial. No KEV listing and no identified public POC further depress urgency. Critically, the attack surface is structurally narrow - Java Web Start was deprecated in Java 9 and removed in Java 11, and browser Java plugin support has been eliminated across all major browsers for years; organizations still running sandboxed Java Web Start applications on Java 8 represent a shrinking and typically well-identified population. The SUSE tag in the intelligence data suggests downstream packaging in SUSE Linux environments, which may warrant patch tracking for those distributions. No data conflicts exist between sources; all signals consistently indicate a low-priority, difficult-to-exploit vulnerability with a niche deployment constraint.

A low-privileged local user on a workstation running Oracle Java SE 8u481 with Java Web Start enabled delivers a malicious Java application - for example via a crafted JNLP file or a link to an internet-hosted applet - to a different user on the same system, who then launches it within the Java sandbox. The Hotspot component's uncontrolled resource consumption flaw is triggered by the malicious code, causing either wholesale corruption of data accessible to the JVM process or a complete hang or crash of the Java runtime, denying service to the victim. No public exploit code has been identified at the time of analysis.