CVE-2002-2022: Kaffe Openvm

High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Format string vulnerability in Kaffe OpenVM 1.0.6 and earlier allows local users to execute arbitrary code, when a java.lang.NoClassDefFoundError is thrown, via format specifiers in the forName attribute.

Affected products

• Kaffe Kaffe Openvm: version 1.0.6 only

Published 2002-12-31. Last modified 2026-06-16.