CVE-2026-83368

Received Received - Intake

Heap Overflow in Oracle GraalVM

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83368

EUVD

EUVD-2026-80054

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	graalvm_for_jdk	23.0.13.1
oracle	graalvm_for_jdk	23.1.12.1
oracle	graalvm_enterprise_edition	21.3.19.1
oracle	graalvm	25.0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GraalVM affecting versions 17, 21, Enterprise Edition, and Oracle GraalVM itself. It exists in the Compiler component and allows unauthenticated attackers to exploit it via HTTP network access. Successful exploitation can lead to unauthorized data access, data modification, and partial denial of service.

Impact Analysis

If you use affected Oracle GraalVM versions, an attacker could access sensitive data, modify or delete data, or disrupt services. This could lead to data breaches, loss of data integrity, or service unavailability for applications relying on GraalVM.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected GraalVM versions may face compliance violations and potential penalties.

Mitigation Strategies

Update Oracle GraalVM for JDK to version 17: 23.0.13.2 or later, JDK 21: 23.1.12.2 or later, GraalVM Enterprise Edition to 21.3.19.2 or later, and GraalVM to 25.0.4.2 or later. Disable HTTP access if not required and restrict network exposure.

Hi! I’m here to help you understand CVE-2026-83368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70