Vulnerability record · CVE-2008-5353 · published 5 December 2008
CVE-2008-5353: Java JRE ZoneInfo deserialization privilege escalation
Sun · Jdk
The Java Runtime Environment fails to enforce the context of ZoneInfo objects during deserialization, allowing untrusted applets and applications to run in a privileged context. This is a sandbox escape in affected Sun JDK/JRE 6 Update 10 and earlier, 5.0 Update 16 and earlier, and SDK/JRE 1.4.2_18 and earlier. Because it defeats the Java security model, it matters for any environment still running these legacy Java versions.
Description
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 10.0 with a network-reachable, unauthenticated sandbox escape and very high EPSS make this a top remediation priority wherever affected Java versions remain.
What it is
The Java Runtime Environment fails to enforce the context of ZoneInfo objects during deserialization, allowing untrusted applets and applications to run in a privileged context. This is a sandbox escape in affected Sun JDK/JRE 6 Update 10 and earlier, 5.0 Update 16 and earlier, and SDK/JRE 1.4.2_18 and earlier. Because it defeats the Java security model, it matters for any environment still running these legacy Java versions.
Impact
An attacker can execute code with the privileges of the Java process, escaping the applet sandbox. That typically means full compromise of the user's session or the host running the JRE.
Attack surface
Reachable remotely over the network with no authentication, per the AV:N/AC:L/Au:N vector, via a malicious applet or application that triggers deserialization of crafted objects such as Calendar objects. Some user interaction (loading the applet or application) is implied by the description but not explicitly stated.
Exploitation
Not listed in CISA KEV and no reference tags indicate known exploitation, but EPSS is very high at 0.858 (99.7th percentile), indicating strong predicted likelihood of exploitation.
What to do
- Patch or upgrade to a Java version that fixes the ZoneInfo deserialization issue; these JDK/JRE 6 Update 10, 5.0 Update 16 and 1.4.2_18 releases are end-of-life and should be replaced.
- Remove or disable legacy Java browser plugins and applet execution where not strictly required.
- Restrict Java applet and Web Start execution via deployment configuration and security policy.
- Block or tightly control outbound and inbound access to untrusted applet sources at the network layer.
- Inventory hosts and applications still running the affected Java versions and prioritize them for remediation.
Detection
- Monitor for Java processes spawning unexpected child processes or making anomalous network connections.
- Alert on loading of applets or JARs from untrusted or external sources.
- Search endpoint logs for Java version strings matching the affected releases to find unpatched hosts.
- Watch for deserialization-related errors or unusual Calendar/ZoneInfo object handling in Java application logs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-5353 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-5353), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
