CVE-2026-91381

A flaw was found in OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification or deletion by submitting untrusted input to APIs in the 2D graphics component. Exploitation can occur through network services that pass data to these APIs or in client environments executing untrusted code within a sandbox.

This vulnerability is rated as having a Low impact because successful exploitation requires complex conditions to supply untrusted data to internal rendering routines and results only in limited integrity impact without compromising confidentiality or availability. In typical Red Hat Enterprise Linux deployments, server-side Java applications rarely expose font parsing and graphics interfaces directly to unauthenticated network sources. Furthermore, the issue is restricted to legacy OpenJDK 8 runtimes, while newer releases such as OpenJDK 11, 17, and 21 are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.