diff --git a/src/share/bin/java.c b/src/share/bin/java.c
index 6f24932e550471f657a555e4da7135d796b8fa65..4c61fb7c8534f788cf05d49ada742b9014c69843 100644
--- a/src/share/bin/java.c
+++ b/src/share/bin/java.c
@@ -712,19 +712,19 @@ SetModulesBootClassPath(const char *jrepath)
     struct stat statbuf;
 
     /* return if jre/lib/rt.jar exists */
-    sprintf(pathname, "%s%slib%srt.jar", jrepath, separator, separator);
+    JLI_Snprintf(pathname, sizeof(pathname), "%s%slib%srt.jar", jrepath, separator, separator);
     if (stat(pathname, &statbuf) == 0) {
         return;
     }
 
     /* return if jre/classes exists */
-    sprintf(pathname, "%s%sclasses", jrepath, separator);
+    JLI_Snprintf(pathname, sizeof(pathname), "%s%sclasses", jrepath, separator);
     if (stat(pathname, &statbuf) == 0) {
         return;
     }
 
     /* modularized jre */
-    sprintf(pathname, "%s%slib%s*", jrepath, separator, separator);
+    JLI_Snprintf(pathname, sizeof(pathname), "%s%slib%s*", jrepath, separator, separator);
     s = (char *) JLI_WildcardExpandClasspath(pathname);
     def = JLI_MemAlloc(sizeof(format)
                        - 2 /* strlen("%s") */
@@ -1624,11 +1624,8 @@ ReadKnownVMs(const char *jrepath, const char * arch, jboolean speculative)
     if (JLI_IsTraceLauncher()) {
         start = CounterGet();
     }
-
-    JLI_StrCpy(jvmCfgName, jrepath);
-    JLI_StrCat(jvmCfgName, FILESEP "lib" FILESEP);
-    JLI_StrCat(jvmCfgName, arch);
-    JLI_StrCat(jvmCfgName, FILESEP "jvm.cfg");
+    JLI_Snprintf(jvmCfgName, sizeof(jvmCfgName), "%s%slib%s%s%sjvm.cfg",
+        jrepath, FILESEP, FILESEP, arch, FILESEP);
 
     jvmCfg = fopen(jvmCfgName, "r");
     if (jvmCfg == NULL) {
diff --git a/src/solaris/bin/java_md.c b/src/solaris/bin/java_md.c
index 96a4ec1a57b42f2d2f8f4a5843ccbcff09404338..ca1ce5b9f0b5fccd95d1591f3295789e4f95de0a 100644
--- a/src/solaris/bin/java_md.c
+++ b/src/solaris/bin/java_md.c
@@ -535,7 +535,7 @@ jboolean
 GetApplicationHome(char *buf, jint bufsize)
 {
     if (execname != NULL) {
-        JLI_StrNCpy(buf, execname, bufsize-1);
+        JLI_Snprintf(buf, bufsize, "%s", execname);
         buf[bufsize-1] = '\0';
     } else {
         return JNI_FALSE;
diff --git a/src/windows/bin/java_md.c b/src/windows/bin/java_md.c
index abd887c94d56a7fe235643225122dfadd483539c..06824ce319cf53d1c712a971b658fc6a72e469a3 100644
--- a/src/windows/bin/java_md.c
+++ b/src/windows/bin/java_md.c
@@ -162,6 +162,10 @@ LoadMSVCRT()
 #endif
 #ifdef CRT_DLL
         if (GetJREPath(crtpath, MAXPATHLEN)) {
+            if (JLI_StrLen(crtpath) + JLI_StrLen("\\bin\\") + JLI_StrLen(CRT_DLL) >= MAXPATHLEN) {
+                JLI_ReportErrorMessage(JRE_ERROR11);
+                return JNI_FALSE;
+            }
             (void)JLI_StrCat(crtpath, "\\bin\\" CRT_DLL);   /* Add crt dll */
             JLI_TraceLauncher("CRT path is %s\n", crtpath);
             if (_access(crtpath, 0) == 0) {
@@ -852,8 +856,7 @@ ExecJRE(char *jre, char **argv) {
     /*
      * If this isn't the selected version, exec the selected version.
      */
-    (void)JLI_StrCat(JLI_StrCat(JLI_StrCpy(path, jre), "\\bin\\"), progname);
-    (void)JLI_StrCat(path, ".exe");
+    JLI_Snprintf(path, sizeof(path), "%s\\bin\\%s.exe", jre, progname);
 
     /*
      * Although Windows has an execv() entrypoint, it doesn't actually