CVE Watch14 ago 2026

CVE-2012-0507

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CVSS

9.8

Crítico

EPSS

98.2%

p100

KEV

SÍ

3 mar 2022

Exploit Today

0-100

Publicado: 7 jun 2012 · Última mod.: 14 ago 2026 · CWE-843

EPSS · 30d

98.1%EPSS · 30 días98.2%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Oracle / Java SE

Vulnerabilidad

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Añadido a KEV

3 mar 2022

Remediar antes de

24 mar 2022

Uso conocido en ransomware

Sí

Descripción resumida

An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2012-0507

Descripción técnica

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-0314—

—

——0A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.9h CVE-2026-1101408.8 ALT

13.3%

——4Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)13h CVE-2026-969215.5 MED

32.1%

——10Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.1d CVE-2026-968545.5 MED

21.7%

——7Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.1d CVE-2026-853777.8 ALT

23.1%

——7Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.1d CVE-2026-837637.8 ALT

27.6%

——8Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.1d