CVE-2025-50106

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

An IMPORTANT severity flaw was found in the Java 2D glyph rendering code of OpenJDK. The original fix for CVE-2025-30749 was incomplete: the CGGlyphImages_GetGlyphImagePtrs method incorrectly calculates pointers to the arrays inside a pre-allocated buffer, causing an out-of-bounds memory access that can crash the Java runtime. The vulnerability is difficult to exploit and requires an unauthenticated attacker with network access to supply crafted data to the affected 2D APIs, for example through a web service that feeds data to those APIs, or in Java deployments such as sandboxed Java Web Start applications or applets that load and run untrusted code and rely on the Java sandbox for security. A successful attack can compromise the confidentiality, integrity, and availability of the Java runtime (CVSS 3.1 base score 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), consistent with the upstream severity. In Red Hat Enterprise Linux, this flaw affects java-1.8.0-openjdk, java-17-openjdk, and java-21-openjdk on multiple RHEL 7, 8, and 9 update streams, as well as java-1.8.0-ibm; fixes are being pursued through the upstream OpenJDK and IBM projects and delivered to the affected Red Hat Enterprise Linux streams via errata. The java-1.6.0-openjdk and java-1.7.0-openjdk packages in the out-of-support RHEL 6 and RHEL 7 streams are out of support and will not receive updates for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.