Vulnerability record · CVE-2012-0507 · published 7 June 2012
CVE-2012-0507: Oracle Java SE JRE AtomicReferenceArray type confusion sandbox bypass
Sun · Jre
CVE-2012-0507 is an unspecified vulnerability in the Java Runtime Environment (JRE) Concurrency component affecting Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier. Oracle has not confirmed the downstream claim that the AtomicReferenceArray class fails to verify the array is of Object[] type, which would allow a JVM crash or a bypass of Java sandbox restrictions. Because it can break the sandbox, it matters as a route to arbitrary code execution in the JVM.
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 3.1 base score is 9.8, it is in CISA KEV with known ransomware use, and EPSS is 0.98113 at the 99.91st percentile.
What it is
CVE-2012-0507 is an unspecified vulnerability in the Java Runtime Environment (JRE) Concurrency component affecting Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier. Oracle has not confirmed the downstream claim that the AtomicReferenceArray class fails to verify the array is of Object[] type, which would allow a JVM crash or a bypass of Java sandbox restrictions. Because it can break the sandbox, it matters as a route to arbitrary code execution in the JVM.
Impact
An attacker can affect confidentiality, integrity and availability, and per the third-party claim can bypass Java sandbox restrictions or crash the JVM. Successful sandbox escape enables arbitrary code execution in the context of the Java process.
Attack surface
Reachable remotely over the network with no authentication and no user interaction per the CVSS vector, via unknown vectors related to Concurrency. In practice this class of JRE flaw is typically triggered by untrusted Java content such as an applet or web-delivered JAR, though the record does not specify the exact delivery path.
Exploitation
CISA added it to KEV on 2022-03-03 with a 2022-03-24 due date and flags known ransomware campaign use; EPSS 30-day probability is 0.98113 (99.91st percentile). Multiple references are tagged Exploit, and third-party reporting describes the attack being rolled into exploit packs.
What to do
- Apply the vendor updates referenced in the Oracle February 2012 CPU and the Red Hat, Debian and SUSE advisories; upgrade JRE to a fixed release.
- Remove or disable outdated Java SE 5, 6 and 7 installations that cannot be patched.
- Disable the Java browser plug-in and block untrusted applet/JAR execution where the plug-in is not required.
- Restrict outbound and inbound access to Java content and enforce application allowlisting to limit execution of untrusted JARs.
- Treat any host still running the affected JRE versions as compromised until triaged, given KEV status and ransomware association.
Detection
- Hunt for JRE versions at or below 7u2, 6u30 and 5.0u33 on endpoints and servers.
- Monitor for JVM crash events and unexpected java.exe/javaw.exe child processes spawning shells or scripting interpreters.
- Review proxy and web logs for retrieval of JAR or applet content from untrusted or newly registered domains.
- Alert on Java processes making anomalous network connections or writing executables to user-writable paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2012-0507 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 24 March 2022.
Affected products
7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-0507 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-0507), CISA KEV, FIRST EPSS (scores of 2026-09-23). This page is refreshed as NVD updates the record.
