{"id":"CVE-2012-0507","published":"2012-06-07T22:55:17Z","modified":"2026-08-14T05:16:51Z","title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","vendor":"Oracle","product":"Java SE","tier":"core","eol":null,"description":{"text":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.  NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions.  NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.","provenance":"source","from":"NVD"},"summary":{"text":"The Java Runtime Environment (JRE) component of Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier contains an unspecified concurrency-related flaw, and one downstream report ties it to the AtomicReferenceArray class, which does not ensure the array is of type Object[]. A remote attacker with no privileges and no required user interaction, using unknown vectors, could affect confidentiality, integrity and availability, or per the reported mechanism, crash the JVM or escape the Java sandbox.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:09Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98189,"percentile":0.99914,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0507","provenance":"source"},"vulncheckKev":{"dateAdded":"2012-07-02","exploitedFirstSeen":"2012-07-02","ransomware":true,"evidence":[{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/wham-bam-the-cutwailblackhole-combo/","date":"2012-07-02"},{"url":"https://d2538mqrb7brka.cloudfront.net/wp-content/uploads/sites/43/2018/03/20134928/theteamspystory_final_t2.pdf","date":"2013-03-20"},{"url":"https://blog.comodo.com/malware/cisco-popular-sites-spreading-ransomware-via-mavlertising/","date":"2014-06-06"},{"url":"https://www.proofpoint.com/us/threat-insight/post/killing-zero-day-in-the-egg","date":"2016-04-07"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf","date":"2021-02-11"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"},{"url":"https://blog.talosintelligence.com/content/files/2023/12/2023_Talos_Year_In_Review.pdf","date":"2023-12-07"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type"}],"references":[{"url":"http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx","tags":["Broken Link","Third Party Advisory"]},{"url":"http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","tags":["Issue Tracking","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133364885411663&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133365109612558&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133847939902305&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=134254866602253&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=134254957702612&w=2","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0508.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0514.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1455.html","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/48589","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48692","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48915","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48948","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48950","tags":["Broken Link","Not Applicable"]},{"url":"http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3","tags":["Broken Link","Exploit"]},{"url":"http://www.debian.org/security/2012/dsa-2420","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/52161","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=788994","tags":["Issue Tracking"]},{"url":"http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx","tags":["Broken Link","Third Party Advisory"]},{"url":"http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","tags":["Issue Tracking","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133364885411663&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133365109612558&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=133847939902305&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=134254866602253&w=2","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=134254957702612&w=2","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0508.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0514.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1455.html","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/48589","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48692","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48915","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48948","tags":["Broken Link","Not Applicable"]},{"url":"http://secunia.com/advisories/48950","tags":["Broken Link","Not Applicable"]},{"url":"http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3","tags":["Broken Link","Exploit"]},{"url":"http://www.debian.org/security/2012/dsa-2420","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/52161","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=788994","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0507","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote network exploitation of exposed Java runtime","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to affect confidentiality, integrity, and availability","start":171,"end":249}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: sandbox bypass evades Java security controls","mappingType":"primary_impact","evidence":[{"from":"description","quote":"bypass Java sandbox restrictions","start":662,"end":694}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: crashes JVM causing application-level denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attackers to cause a denial of service (JVM crash)","start":601,"end":658}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"nt Internet Explorer security\r\nupdates released in 2014 added an isolated heap mechanism and a\r\n0.000%\r\n0.002%\r\n0.004%\r\n0.006%\r\n0.008%\r\n0.010%\r\n0.012%\r\n0.014%\r\n0.016%\r\n0.018%\r\n3Q15 4Q15 1Q16 2Q16\r\nEncounter rate (percent of all reporting computers)\r\nCVE-2012-1723\r\nCVE-2010-0840\r\nCVE-2013-0422\r\nObfuscator\r\nCVE-2012-0507","start":102048,"end":102368},{"quote":" CVE-2012-0507 allows an unsigned Java applet to gain","start":105188,"end":105242},{"quote":"CVE-2012-0507, 57","start":261334,"end":261351}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2012-0507","start":82539,"end":82552},{"quote":" CVE-2012-0507 allows an unsigned Java applet to gain elevated permissions","start":86104,"end":86179},{"quote":"CVE-2012-0507, 47, 49","start":238099,"end":238120}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-0539","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0539","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":18679,"url":"https://www.exploit-db.com/exploits/18679","title":"Java - AtomicReferenceArray Type Violation (Metasploit)","type":"remote","platform":"multiple","date":"2012-03-30","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2012-03-30"},"metasploit":[{"name":"Java AtomicReferenceArray Type Violation Vulnerability","module":"exploit/multi/browser/java_atomicreferencearray","type":"exploit","disclosureDate":"2012-02-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_atomicreferencearray.rb"}],"first":{"date":"2012-02-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_atomicreferencearray.rb"},"provenance":"source"},"exploitRefs":["http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3","http://www.securityfocus.com/bid/52161"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1211","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2012-02-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2012-03-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_atomicreferencearray.rb","provenance":"source"},{"date":"2012-06-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0507","provenance":"source"},{"date":"2012-07-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/wham-bam-the-cutwailblackhole-combo/","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0539","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3556},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5232 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}