CVE-2012-4420: Oracle JDK

High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days.

An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

Affected products

• Oracle JDK: version 7.0 only

Published 2019-12-26. Last modified 2026-06-16.