CVE-2009-3867: Sun Java SE HsbParser.getSoundBank stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 2.0 score of 9.3 and high EPSS probability indicate severe impact and elevated likelihood, though no KEV listing or confirmed active exploitation is present.

What it is

A stack-based buffer overflow exists in the HsbParser.getSoundBank function in Sun Java SE (JDK and JRE). A remote attacker can trigger it by supplying a long file: URL as an argument, leading to arbitrary code execution. The flaw affects JDK/JRE 5.0 before Update 22, 6 before Update 17, and SDK/JRE 1.3.x and 1.4.x before their respective updates.

Impact

Successful exploitation allows remote code execution with the privileges of the Java process, giving the attacker full control over confidentiality, integrity, and availability of the affected system.

Attack surface

The vulnerability is network-reachable (AV:N) and requires no authentication (Au:N), but exploitation requires some user interaction or a non-default condition (AC:M), such as loading a crafted file: URL argument. No specific delivery vector beyond the argument is described.

Exploitation

The CVE is not listed in CISA KEV, but EPSS shows a high 30-day probability (0.73376, 99.4th percentile). Multiple references include Patch and Vendor Advisory tags, indicating patches are available; no public exploit code is explicitly referenced.

What to do

• Apply the vendor patches: upgrade to JDK/JRE 5.0 Update 22 or later, JDK/JRE 6 Update 17 or later, SDK/JRE 1.3.1_27 or later, and SDK/JRE 1.4.2_24 or later.
• If immediate patching is not possible, restrict the ability to pass untrusted file: URLs to Java applications and disable Java in browsers where not required.
• Monitor and limit Java applet and Web Start execution from untrusted sources.
• Apply operating system and browser vendor updates that bundle the fixed Java versions (e.g., Apple, Red Hat, openSUSE advisories).

Detection

• Monitor for Java processes spawning child processes or making unexpected network connections, which may indicate post-exploitation activity.
• Inspect application and system logs for crashes or errors in HsbParser.getSoundBank or related soundbank parsing.
• Use file integrity monitoring on Java installations to detect unauthorized changes to JRE/JDK binaries.
• Search for unusual file: URL arguments passed to Java applications in command-line or process creation logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.