Oracle has not commented on promises from the reliable researcher that this is the heap-based buffer overflow that permits remote attackers to execute arbitrary code, connected with an "invalid assignment" and https://www.darkexploits.com/product/extremely-silent-jpg-exploit-new/