CVE-2026-83357

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in Oracle GraalVM for JDK

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-83357

EUVD

EUVD-2026-80052

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	graalvm_for_jdk	23.0.13.1
oracle	graalvm_for_jdk	23.1.12.1
oracle	graalvm	25.0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GraalVM for JDK and Oracle GraalVM products. It affects versions 17: 23.0.13.1, 21: 23.1.12.1, and 25.0.4.1. The issue is in the Compiler component and allows unauthenticated attackers with network access via HTTP to potentially take over the affected systems.

Impact Analysis

An attacker could exploit this to gain full control of the Oracle GraalVM for JDK or Oracle GraalVM, leading to potential data breaches, unauthorized code execution, or system downtime. The high CVSS score indicates significant confidentiality, integrity, and availability impacts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected versions must address this to maintain compliance.

Mitigation Strategies

Update Oracle GraalVM for JDK to version 23.0.13.1 or later for JDK 17, 23.1.12.1 or later for JDK 21, or 25.0.4.1 or later for Oracle GraalVM. Apply the latest security patches from Oracle to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-83357. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70