CVE WatchAug 14, 2026

CVE-2012-0507

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CVSS

9.8

Critical

EPSS

98.2%

p100

KEV

YES

Mar 3, 2022

Exploit Today

0-100

Published: Jun 7, 2012 · Last modified: Aug 14, 2026 · CWE-843

EPSS · 30d

98.1%EPSS · 30 days98.2%

2026-09-162026-10-14

KEV catalog record

Product

Oracle / Java SE

Vulnerability

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Added to KEV

Mar 3, 2022

Remediate by

Mar 24, 2022

Known ransomware use

Yes

Summary description

An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2012-0507

Technical description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-0314—

—

——0A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.16h CVE-2026-1101408.8 HIG

13.3%

——4Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)9h CVE-2026-969215.5 MED

32.1%

——10Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.2d CVE-2026-968545.5 MED

21.7%

——7Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.2d CVE-2026-853777.8 HIG

23.1%

——7Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.2d CVE-2026-837637.8 HIG

27.6%

——8Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.2d