JUCE Security
1. Reporting a vulnerability
Suspected security vulnerabilities in JUCE, in the Projucer, in bundled third-party components, or in JUCE web infrastructure should be reported to security@juce.com.
Please do not use public GitHub issues or the forum for security reports. Include the information listed in our SECURITY.md.
| Stage | Target |
|---|---|
| Acknowledgement | 2 business days |
| Initial assessment (accepted / declined / more info needed) | 10 business days |
| Fix or mitigation for confirmed vulnerabilities | within 90 days, coordinated with the reporter |
| Public advisory | at fix availability, on an agreed date |
We follow coordinated disclosure and offer safe harbour to good-faith researchers as described in SECURITY.md. We credit reporters in advisories unless they prefer otherwise.
2. Security advisories
When we fix a confirmed vulnerability we publish a notice in the Security Advisories section of the JUCE Forum.
We strongly recommend that every team shipping products built with JUCE subscribes to notifications from the Security Advisories section of the JUCE Forum. If you hold a commercial JUCE licence, security notices are also sent to the contact email on your licence account; please keep it current.
Where a vulnerability is being actively exploited, we will notify affected users without undue delay after becoming aware, including available mitigations, in line with our obligations under Article 14(8) of the EU Cyber Resilience Act.
3. Supported versions and security-support periods
Security fixes are provided for the versions below until the stated dates. After the end date a version no longer receives security updates and users should migrate to a supported major version.
| Version | Released | Security support until |
|---|---|---|
| JUCE 9.0.x | 2026-07-21 | 2031-07-21 |
| JUCE 8.0.x | 2024-06-12 | 2029-06-12 |
| JUCE 7.0.x | 2022-06-21 | 2027-06-21 |
| JUCE 6.x and earlier | — | No longer supported |
Security fixes are delivered as point releases on the supported branch and noted in the changelog and advisory.
4. Secure use of JUCE
Watch the advisory channel above; vulnerabilities in JUCE or its bundled components may affect your products and may create obligations for you as the manufacturer of those products.
Instructions for installing updates: Check out the updated version of JUCE from GitHub, or download the updated version of JUCE from the JUCE website, then rebuild your product; no runtime update mechanism is involved.
Decommissioning: JUCE itself stores no user data and removing the framework from a codebase removes it entirely.
5. Software Bill of Materials
Every JUCE release from 9.0.2 includes a machine-readable SPDX SBOM covering JUCE’s modules and all bundled third-party components with exact versions where available from upstream publishers.
Commercial licensees may incorporate these SBOMs into the technical documentation of their own products.
Not all of the dependencies listed in JUCE’s SPDX SBOM will be present in software built with JUCE. Some items are build/compilation environment only, or in JUCE modules that are not used by the software incorporating JUCE.
6. EU Cyber Resilience Act statement
JUCE is made available in the European Union by Raw Material Software Limited, which acts as the manufacturer of JUCE under Regulation (EU) 2024/2847 (the Cyber Resilience Act). In that capacity we:
- operate the coordinated vulnerability disclosure process described on this page;
- maintain SBOMs for each release and technical documentation for the framework;
- provide security updates for supported versions for the periods published above;
- notify ENISA and affected users of actively exploited vulnerabilities and severe incidents in accordance with Article 14; and
- report vulnerabilities we discover in bundled third-party components to their maintainers in accordance with Article 13(6).
Contact for vulnerability reports and security matters: security@juce.com.
Manufacturer contact details:
Raw Material Software Limited, 5 Technology Park, Colindeep Lane, London, NW9 6BX, UK
7. Reporting vulnerabilities in products built with JUCE
We provide the JUCE framework; we are not the manufacturer of applications built with it. Vulnerabilities in a specific application should be reported to that application’s vendor. If the root cause lies in JUCE itself, we welcome the report at security@juce.com and will coordinate with the vendor where appropriate.