CVE-2026-70906

A flaw was found in OpenJDK. A remote attacker could cause a denial of service (DoS) by supplying a specially crafted font file. Processing the malicious font triggers an unrecoverable exception during a Foreign Function and Memory (FFM) API upcall, forcing the Java Virtual Machine (JVM) to terminate unexpectedly.

This vulnerability is evaluated as a Moderate severity issue because, while an attacker can cause denial of service by terminating the runtime process, it does not allow privilege escalation or unauthorized data exposure. Exploitation requires a Java application to parse or render externally supplied font files using Foreign Function and Memory interfaces. Common production environments running supported Long Term Support versions, such as OpenJDK 17 and 21, are not affected as the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.