CVE-2010-0842: Oracle Java Sound component array index flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 2.0 score of 7.5 with network reachability, no authentication, and high EPSS percentile indicate significant risk, though the lack of confirmed technical details and KEV listing prevents a critical rating.

What it is

An unspecified vulnerability in the Sound component of Oracle Java SE and Java for Business (6 Update 18, 5.0 Update 23, 1.4.2_25, 1.3.1_27) can be triggered by unknown vectors. Oracle has not confirmed researcher claims that it is an uncontrolled array index reachable via a crafted MIDI file with a MixerSequencer object related to the GM_Song structure, allowing arbitrary code execution. The flaw affects confidentiality, integrity, and availability.

Impact

A remote attacker can potentially execute arbitrary code in the context of the Java process, leading to full compromise of confidentiality, integrity, and availability. If the array index claim is accurate, code execution occurs without authentication.

Attack surface

The CVSS vector AV:N/AC:L/Au:N/C:P/I:P/A:P indicates the flaw is network-reachable with no authentication required and low attack complexity. Exploitation likely requires the victim to load or process a malicious MIDI file, implying some user interaction or application-level parsing of untrusted media.

Exploitation

CVE-2010-0842 is not listed in CISA KEV and has no ransomware associations. EPSS probability is 0.77721 (99.543 percentile), indicating a high likelihood of exploitation activity, though no public exploit references are tagged in the record.

What to do

• Apply the Oracle Java SE and Java for Business updates referenced in the March 2010 CPU and subsequent Oracle advisories.
• Upgrade to a supported Java version beyond the affected 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 releases.
• Disable or restrict Java applet and Java Web Start execution in browsers and untrusted contexts where feasible.
• Block or inspect MIDI file handling in Java applications that process untrusted media, if the MixerSequencer vector is confirmed.
• Monitor vendor advisories from Red Hat, Apple, and openSUSE for platform-specific patches.

Detection

• Monitor for Java processes spawning unexpected child processes or making anomalous network connections after loading MIDI files.
• Inspect application logs for crashes or exceptions in the Java Sound component, particularly around MixerSequencer or GM_Song handling.
• Use file inspection to detect MIDI files with malformed or unusually large MixerSequencer structures entering Java applications.
• Correlate Java process behavior with known exploitation indicators from Oracle CPU and third-party advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.