CVE-2026-83408

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in Oracle GraalVM for JDK

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83408

EUVD

EUVD-2026-80053

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	graalvm_for_jdk	23.0.13.1
oracle	graalvm_for_jdk	23.1.12.1
oracle	graalvm	25.0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GraalVM for JDK and Oracle GraalVM products. It affects specific versions: GraalVM for JDK 17 (23.0.13.1), GraalVM for JDK 21 (23.1.12.1), GraalVM (25.0.4.1). The issue is in the Compiler component and allows unauthenticated attackers to remotely exploit it via HTTP to potentially take over the affected systems.

Impact Analysis

If exploited, this vulnerability could allow an attacker to fully compromise the Oracle GraalVM for JDK or Oracle GraalVM, leading to complete system takeover. This could result in unauthorized access, data breaches, or disruption of services relying on these components.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions must address this to maintain compliance and avoid potential legal or financial penalties.

Mitigation Strategies

Update Oracle GraalVM for JDK to version 23.0.13.2 or later for JDK 17, 23.1.12.2 or later for JDK 21, and 25.0.4.2 or later for GraalVM. Disable HTTP access if not required and restrict network access to the vulnerable component.

Hi! I’m here to help you understand CVE-2026-83408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70