CVE-2026-95509

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

  • Published Sep 29, 2026
  • CVSS 8.8 high
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-95509 at the National Vulnerability Database