PT-2026-3675 · Oracle+4 · Graalvm For Jdk 21.0.9+14

Published 2026-01-20 · Updated 2026-05-08 · CVE-2026-21925

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u471, 8u471-b50, 8u471-perf Oracle Java SE version 11.0.29 Oracle Java SE version 17.0.17 Oracle Java SE version 21.0.9 Oracle Java SE version 25.0.1 Oracle GraalVM for JDK versions 17.0.17 and 21.0.9 Oracle GraalVM Enterprise Edition version 21.3.16

Description A difficult to exploit issue exists in the RMI component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access via multiple protocols can compromise the software. Successful attacks may lead to unauthorized data modification, insertion, deletion, or reading of accessible data. The issue can be exploited through APIs, such as via a web service supplying data to these APIs. It also affects Java deployments that load and run untrusted code, relying on the Java sandbox for security.

Recommendations Oracle Java SE versions prior to 8u471, 8u471-b50, 8u471-perf should be updated. Oracle Java SE version 11.0.29 should be updated. Oracle Java SE versions prior to 17.0.17 should be updated. Oracle Java SE versions prior to 21.0.9 should be updated. Oracle Java SE versions prior to 25.0.1 should be updated. Oracle GraalVM for JDK versions prior to 17.0.17 and 21.0.9 should be updated. Oracle GraalVM Enterprise Edition version 21.3.16 should be updated.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2026:0927

ALSA-2026:0928

ALSA-2026:0932

ALSA-2026:0933

BDU:2026-00695

BIT-JAVA-2026-21925

BIT-JAVA-MIN-2026-21925

BIT-JRE-2026-21925

CVE-2026-21925

MGASA-2026-0024

OPENSUSE-SU-2026:10091-1

OPENSUSE-SU-2026:10092-1

OPENSUSE-SU-2026:10093-1

OPENSUSE-SU-2026:10108-1

OPENSUSE-SU-2026:10133-1

OPENSUSE-SU-2026:10134-1

OPENSUSE-SU-2026:10135-1

OPENSUSE-SU-2026:10136-1

OPENSUSE-SU-2026:10137-1

OPENSUSE-SU-2026:10138-1

OPENSUSE-SU-2026:20126-1

OPENSUSE-SU-2026:20134-1

OPENSUSE-SU-2026:20143-1

RHSA-2026:0847

RHSA-2026:0927

RHSA-2026:0928

RHSA-2026:0931

RHSA-2026:0932

RHSA-2026:0933

RHSA-2026:4832

SUSE-SU-2026:0341-1

SUSE-SU-2026:0342-1

SUSE-SU-2026:0363-1

SUSE-SU-2026:0382-1

SUSE-SU-2026:0389-1

SUSE-SU-2026:0390-1

SUSE-SU-2026:0414-1

SUSE-SU-2026:0415-1

SUSE-SU-2026:0441-1

SUSE-SU-2026:0504-1

SUSE-SU-2026:20190-1

SUSE-SU-2026:20199-1

SUSE-SU-2026:20215-1

USN-7995-1

USN-7996-1

USN-7997-1

USN-7998-1

USN-8000-1

USN-8001-1

USN-8002-1

USN-8003-1

Affected Products

Graalvm Enterprise Edition 21.3.16

Graalvm For Jdk 17.0.17

Graalvm For Jdk 21.0.9

Java Platform

Java Se 11.0.29

Java Se 17.0.17

Java Se 21.0.9

Java Se 25.0.1

Java Se 8U471

Java Se 8U471-B50

Java Se 8U471-Perf

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 133

• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10093-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-0928.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7998-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jre-2026-21925 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21945 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0441-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10091-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:0933 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00695 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10092-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0363-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:0927 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10136-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0504-1 · Vendor Advisory