CVE-2026-95509

The vulnerability arises from incorrect buffer size calculations when handling Latin-1 characters in String.arg(), leading to potential out-of-bounds reading. This flaw can be exploited to access sensitive data or execute arbitrary code, posing a significant risk to applications that rely on string formatting. Organizations utilizing affected products should prioritize patching this vulnerability to mitigate potential exploitation risks.