CVE-2026-91375

A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.

This vulnerability is rated as having a Moderate impact for Red Hat deployments because exploitation requires high attack complexity, local access, and user interaction, while the impact is strictly confined to data integrity. In typical enterprise environments, OpenJDK applications do not routinely process untrusted module archives unless explicitly architected to ingest external jmod files or untrusted input via exposed application interfaces. Furthermore, earlier runtimes such as OpenJDK 8 do not include modular runtime archive features and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.