The Graphics.copyArea operation with extreme values can trigger a heap corruption scenario.
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/68d10daabaf9c939a5d2e665994c6d348f38cfd5 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/ea1389c971827876134a6d1d3ab2934681e9f3d6 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/0a89eb2588334226531e8e25ac340eabbc00bd6d OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/3048e287d8ea7d5e0d19d9188eb4212801ebf2a2
This CVE was fixed in Oracle Java SE 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1. Release notes: https://www.oracle.com/java/technologies/javase/8u451-relnotes.html#R180_451 https://www.oracle.com/java/technologies/javase/8u451-perf-relnotes.html https://www.oracle.com/java/technologies/javase/11-0-27-relnotes.html#R11_0_27 https://www.oracle.com/java/technologies/javase/17-0-15-relnotes.html#R17_0_15 https://www.oracle.com/java/technologies/javase/21-0-7-relnotes.html https://www.oracle.com/java/technologies/javase/24-0-1-relnotes.html