CVE-2025-11919: Default JVM Insecure Shared /tmp Handling Enables Classpath Hijacking

Overview

CVE-2025-11919 describes a weakness in the default Java Virtual Machine (JVM) in which the JVM can access files and directories under /tmp/, including another user's temporary directory on the same cloud instance. According to the record, an initialization file used at JVM startup exists in the vulnerable directory, and files placed there can be resolved before legitimate libraries on the classpath. The record does not name the product or the vendor. CERT/CC is the CVE Numbering Authority.

Impact

• The record describes a scenario in which a party with access to the shared temporary space can influence which .jar files or directories the JVM resolves first, which could lead to loading attacker-controlled classes during startup.
• The reported CVSS 3.1 base score is 9.6 (critical), with high confidentiality and integrity impact, no availability impact, and a changed scope.
• The reported attack vector is network (AV:N), while the description refers to access to a shared /tmp space on the same instance. This difference should be reviewed against the advisory.

Affected products and versions

• The record contains no affected product, version, or platform entries.
• Affected versions are unknown based on the available information.
• The Java runtime version and distribution affected by this issue are not stated in the record.

Exploitation status

• The record shows the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
• No confirmed exploitation appears in the sources consulted.
• The record includes an EPSS probability of 0.00487 and a percentile of 0.40203, which estimate likelihood of exploitation and do not confirm it.

Remediation and mitigation

• The record lists no fixed version. The absence of a fixed version does not mean that no fix exists; check the CERT/CC advisory linked in the record and the vendor guidance for your JVM distribution.
• Restrict access to shared temporary directories and avoid running sensitive JVM workloads on instances where untrusted local users share /tmp.
• Use private per-user temporary locations with restrictive permissions instead of shared directories.
• Keep classpath entries limited to controlled, non-shared locations and verify the integrity of libraries before startup.
• Apply vendor updates once a fix is published for your JVM version.

Detection guidance

• Monitor the creation or replacement of .jar files and directories in /tmp by accounts other than the owning user.
• Review JVM startup logs and classpath configuration for unexpected entries or unexpected class loading from temporary locations.
• Compare library hashes on critical systems against known-good baselines to identify substituted files.

Limitations of the available information

• Affected product, versions, and platforms are not identified in the record.
• No fixed version or vendor patch is listed.
• No CWE classification is assigned in the record.
• The published date and the EPSS date in the record should be verified against the official CVE entry.
• The record references a third-party disclosure repository; its content was not used for this analysis.

Frequently asked questions

What is CVE-2025-11919?

It is a critical issue in the default Java Virtual Machine where files in the shared /tmp directory can influence which libraries are loaded from the classpath during startup. The record reports a CVSS 3.1 base score of 9.6.

Is there a fix for CVE-2025-11919?

The record does not list a fixed version. Check the linked CERT/CC advisory and your JVM vendor's guidance, since a missing fixed version in the record does not mean no fix exists.

Is CVE-2025-11919 being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.