CVE-2026-91382
Description
A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).
Statement
This vulnerability is classified as Moderate severity because successful exploitation demands high attack complexity, requiring an application to expose endpoints that feed untrusted graphical assets into OpenJDK 2D processing routines. In standard Red Hat Enterprise Linux deployments, Java applications are not broadly exposed unless services explicitly accept and render external image data without prior validation. Because the flaw cannot be leveraged to read confidential system memory or achieve arbitrary remote command execution, the impact remains limited to data tampering and partial service disruption within the executing runtime process.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When untrusted input is not properly validated for the expected syntax, attackers could cause parsing failures, trigger unexpected errors, or expose latent vulnerabilities that might not be directly exploitable if the input had conformed to the syntax.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
