The original fix for CVE-2025-30749 was found to be incomplete. In particular, the CGGlyphImages_GetGlyphImagePtrs method incorrectly calculates pointers to the arrays inside the pre-allocated buffer. It caused out-of-memory access and crash.
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/943a5ea328fd2fc8eed0aed4ec9b1957d41f8144 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/141d7af9cd3c41de974c3d3f8017d6b21dc6d36c OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/dc37bab65cb052ecae715bc8e71efa116c16b034 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/2801e11e634e386b0c9fd9e44f7eab3d191e748e
This CVE was fixed in Oracle Java SE 8u461, 11.0.28, 17.0.16, 21.0.8. https://www.oracle.com/java/technologies/javase/8u461-relnotes.html#R180_461 https://www.oracle.com/java/technologies/javase/11-0-28-relnotes.html#R11_0_28 https://www.oracle.com/java/technologies/javase/17-0-16-relnotes.html#R17_0_16 https://www.oracle.com/java/technologies/javase/21-0-8-relnotes.html
This issue has been addressed in the following products: RHOSS-1.36-RHEL-8 Via RHSA-2026:0934 https://access.redhat.com/errata/RHSA-2026:0934