CVE-2026-91415

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.

This vulnerability is rated as Important because unauthenticated remote threats can cause a full service disruption or compromise memory integrity in workloads utilizing OpenJDK 2D subsystems. In Red Hat Enterprise Linux and container environments, exposure is contingent on whether server applications ingest and render untrusted font or graphical assets. Java workloads that do not process external visual assets or expose rendering interfaces to network callers face minimal practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.