Oracle Java SE EUVD-2026-46499

Exploitation requires that the target application exposes Java ImageIO APIs to network-supplied data - either through a web service that accepts and processes image uploads/URLs, or through a sandboxed Java Web Start application or Java applet environment that loads untrusted code from the internet. The AC:H metric confirms that specific, difficult-to-arrange conditions must be met; exploitation is not trivial against arbitrary Java deployments. Exploitation is limited to integrity impact only (no data theft, no service disruption). Java deployments that do not process untrusted image input via ImageIO APIs are not exposed to this vulnerability. Modern server-side Java applications not using ImageIO for externally supplied content are unaffected in practice. The sandboxed applet/Web Start vector is largely moot in JDK 11+ environments where these technologies were removed.

Real-world risk is materially lower than the attack surface would suggest. The CVSS 3.7 (Low) score reflects two critical dampening factors: AC:H (high attack complexity, meaning exploitation requires specific, difficult-to-arrange conditions) and an impact limited exclusively to data integrity (I:L) with no confidentiality or availability impact. EPSS data is not provided in the source intelligence; given the low CVSS and AC:H, exploitation probability is likely low. No KEV listing and no public POC means this is not under active opportunistic exploitation at time of analysis. The 'Authentication Bypass' tag may overstate the severity - the CVSS PR:N metric confirms no credentials are needed, but the limited I:L integrity impact suggests partial rather than full bypass. The primary concern is environments where Java processes untrusted image data from the network, or legacy sandboxed Java Web Start deployments still in use. For server-side deployments not processing untrusted images, risk is negligible. CVSS indicates network vector but exploitation is constrained to high complexity - defenders should not treat this as easily exploitable over the network.

An attacker sends a specially crafted image file to a web service that internally calls Java's ImageIO APIs to parse or process the image - for example, an image resizing or thumbnail generation endpoint. Due to a flaw in ImageIO processing, the attacker achieves unauthorized modification of some accessible data, such as corrupting or overwriting stored image metadata or application state. The high attack complexity means the attacker likely needs precise knowledge of the target's image processing pipeline and may need to time or structure the request carefully to trigger the vulnerable code path.