Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .9811 99.9 YES
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jan 11 Reserved by oracle Mar 3 Added to CISA KEV, remediation due 2022-03-24 Mar 3 Published (CNA: oracle) Aug 14 EXPLOIT PUBLISHED — CVE-2012-0507. Public exploit reference added.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
| Date | Event | Detail |
|---|---|---|
| January 11, 2012 | Reserved | Reserved by oracle |
| March 3, 2022 | KEV ADDED | Added to CISA KEV, remediation due 2022-03-24 |
| March 3, 2022 | Published | Published (CNA: oracle) |
| August 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2012-0507. Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | n/a | — | n/a | — |
Authoritative record: CVE-2012-0507 at cve.org
Weaknesses: CWE-843
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2012-0507 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.