CVE-2026-70906: High severity Oracle Java SE (2D) vulnerability
A specially crafted font file can trigger an unrecoverable exception during an FFM upcall, causing the JVM to exit.
Other sources
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.4.1+1-1~deb13u1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.4.1+1-1 - Upgrade
Upgrade
debian/openjdk-11to a version that resolves this vulnerability.Fixed in 11.0.33+9-1 - Upgrade
Upgrade
debian/openjdk-17to a version that resolves this vulnerability.Fixed in 17.0.19+10-1~deb12u2Fixed in 17.0.21+9-1~deb12u1Fixed in 17.0.21.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.12.1+1-1~deb13u1Fixed in 21.0.13+9-1~deb13u2Fixed in 21.0.13+9-1Fixed in 21.0.13.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1Fixed in 25.0.5+8-1Fixed in 25.0.5.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-26to a version that resolves this vulnerability.Fixed in 26.0.2.1+1-1 - Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u504-ga-1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Affected Oracle Java SE 25.0.4 and 26.0.2 deployments are exposed when an attacker can supply data to 2D APIs through a network-reachable path, such as a web service. Client deployments that run untrusted code in sandboxed Java Web Start applications or sandboxed Java applets are also affected.
Does exploitation require authentication, user interaction, or special conditions?
No. The CVSS vector indicates network access, low attack complexity, no privileges required, and no user interaction; exploitation may occur through multiple protocols.
What is the expected impact if exploitation succeeds?
Successful exploitation can cause Oracle Java SE to hang or repeatedly crash, resulting in a complete denial of service. The provided CVSS information identifies availability impact only, with no confidentiality or integrity impact.
How can I determine whether an environment is affected?
Check whether the deployment uses Oracle Java SE 25.0.4 or 26.0.2 and uses the 2D component. Prioritize systems that expose application paths accepting network-supplied data for 2D APIs, or clients that execute untrusted sandboxed Java Web Start applications or applets.