CVE-2026-22003

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u481 and 8u481-b50; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 6.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H).

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openjdk-8	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
openjdk-9	26.04 LTS resolute	Not in release
	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	16.04 LTS xenial	Ignored no longer supported by upstream
openjdk-lts	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
openjdk-13	26.04 LTS resolute	Not in release
	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Ignored superseded by openjdk-17
openjdk-16	26.04 LTS resolute	Not in release
	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Ignored superseded by openjdk-17
openjdk-17	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
openjdk-17-crac	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
openjdk-18	26.04 LTS resolute	Not in release
	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Ignored superseded by openjdk-19
openjdk-21	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
openjdk-21-crac	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
openjdk-25	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation

Severity score breakdown

Parameter	Value
Base score	6.0 · Medium
Attack vector	Local
Attack complexity	High
Privileges required	Low
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

References

Other references

https://www.cve.org/CVERecord?id=CVE-2026-22003