---
id: CVE-2026-91381
title: 'openjdk: Enhance Font Rendering (Oracle CPU 2026-10) (CVE-2026-91381)'
summary: >-
  A flaw was found in OpenJDK. This vulnerability allows an unauthenticated
  remote attacker to cause unauthorized data modification or deletion by
  submitting untrusted input to APIs in the 2D graphics component. Exploitation
  can occur throug…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: vendor
cwe: CWE-749
vendor: Red Hat
product: Red Hat Enterprise Linux 7
affected:
  - build_of_openjdk 1.8
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-20'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T22:00:59+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91381.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91381.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-91381'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557153'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-91381'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91381'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2026.html'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00232
epssPercentile: 0.14021
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T15:08:36.414766Z'
ingestedAt: '2026-10-20T22:23:33.781Z'
---

## Overview

A flaw was found in OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification or deletion by submitting untrusted input to APIs in the 2D graphics component. Exploitation can occur through network services that pass data to these APIs or in client environments executing untrusted code within a sandbox.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat build of OpenJDK 1.8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat build of OpenJDK 1.8, Red Hat Enterprise Linux 8, … · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91381.json)

**openjdk: Enhance Font Rendering (Oracle CPU 2026-10)** — rated Low by Red Hat. Released 2026-10-20, updated 2026-10-22.

Affected:

- Red Hat build of OpenJDK 1.8
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat build of OpenJDK 1.8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat build of OpenJDK 11 ELS
- Red Hat build of OpenJDK 17
- Red Hat build of OpenJDK 21
- Red Hat build of OpenJDK 25
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images

## Remediation

Out of support scope