CVE-2026-91400

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.

This vulnerability is rated as Low severity because exploitation requires user interaction to parse malicious input and is restricted to causing a partial denial of service. OpenJDK environments on Red Hat Enterprise Linux are primarily deployed for server-side workloads executing trusted applications rather than sandboxed client applets. As a result, standard deployments that do not load or process untrusted multimedia sound resources are not exposed to significant operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.