CVE-2025-30749

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-30749 is a vulnerability in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Affected releases include Oracle Java SE versions 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, and 24.0.1; GraalVM for JDK versions 17.0.15, 21.0.7, and 24.0.1; and GraalVM Enterprise Edition 21.3.14. The flaw carries a CVSS 3.1 base score of 8.1 with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

An unauthenticated network attacker can exploit the issue over multiple protocols to achieve full takeover of affected Java runtimes. The vulnerability is relevant only to client-side deployments that execute untrusted code inside the Java sandbox, such as applets or Web Start applications loaded from the internet; server-side deployments that run only trusted code are unaffected. Successful exploitation requires the attacker to overcome high attack complexity.

Oracle addressed the issue in the July 2025 Critical Patch Update. Debian LTS advisories also reference the fix for supported distributions. The associated EPSS score has remained flat at 0.0212 with no observed increase after disclosure.