CVE-2003-0896: Sun JRE

High severity, CVSS 7.5. EPSS: 14.3% chance of exploitation in the next 30 days.

The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.

Affected products

• Sun JRE: up to and including 1.4.1

Published 2003-11-17. Last modified 2026-06-16.