Several scenarios of heap corruption were observed for Graphics2D.drawString(String,float,float) with varying settings for RenderingHints and affine font transformations.
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/33624e872e7d40d3059f4c0d2967f140305378b8 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/25101ecf5abb77532f39de43758f6dd5614d7795 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/5b443e9e817fa206dfaa87d9e2b9dbc87daa027f OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/10a28c0f67b458e2ec273d2e792c75493f8e6d67
This CVE was fixed in Oracle Java SE 8u461, 11.0.28, 17.0.16, 21.0.8. https://www.oracle.com/java/technologies/javase/8u461-relnotes.html#R180_461 https://www.oracle.com/java/technologies/javase/11-0-28-relnotes.html#R11_0_28 https://www.oracle.com/java/technologies/javase/17-0-16-relnotes.html#R17_0_16 https://www.oracle.com/java/technologies/javase/21-0-8-relnotes.html
This issue has been addressed in the following products: RHOSS-1.36-RHEL-8 Via RHSA-2026:0934 https://access.redhat.com/errata/RHSA-2026:0934