--- a/src/share/classes/javax/imageio/spi/ServiceRegistry.java	Fri Jul 14 04:40:15 2017 +0100
+++ b/src/share/classes/javax/imageio/spi/ServiceRegistry.java	Fri Jul 14 04:55:25 2017 +0100
@@ -26,6 +26,9 @@
 package javax.imageio.spi;
 
 import java.io.File;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -690,11 +693,12 @@
 
     Class category;
 
-    // Provider Objects organized by partial oridering
-    PartiallyOrderedSet poset = new PartiallyOrderedSet();
+    // Provider Objects organized by partial ordering
+    final PartiallyOrderedSet poset = new PartiallyOrderedSet();
 
     // Class -> Provider Object of that class
-    Map<Class<?>,Object> map = new HashMap();
+    final Map<Class<?>,Object> map = new HashMap();
+    final Map<Class<?>,AccessControlContext> accMap = new HashMap<>();
 
     public SubRegistry(ServiceRegistry registry, Class category) {
         this.registry = registry;
@@ -709,6 +713,7 @@
             deregisterServiceProvider(oprovider);
         }
         map.put(provider.getClass(), provider);
+        accMap.put(provider.getClass(), AccessController.getContext());
         poset.add(provider);
         if (provider instanceof RegisterableService) {
             RegisterableService rs = (RegisterableService)provider;
@@ -728,6 +733,7 @@
 
         if (provider == oprovider) {
             map.remove(provider.getClass());
+            accMap.remove(provider.getClass());
             poset.remove(provider);
             if (provider instanceof RegisterableService) {
                 RegisterableService rs = (RegisterableService)provider;
@@ -773,11 +779,21 @@
             iter.remove();
 
             if (provider instanceof RegisterableService) {
-                RegisterableService rs = (RegisterableService)provider;
-                rs.onDeregistration(registry, category);
+                final RegisterableService rs = (RegisterableService)provider;
+                AccessControlContext acc = accMap.get(provider.getClass());
+                if (acc != null || System.getSecurityManager() == null) {
+                    AccessController.doPrivileged(new PrivilegedAction<Void>() {
+                        @Override
+                        public Void run() {
+                            rs.onDeregistration(registry, category);
+                            return null;
+                        }
+                    }, acc);
+                }
             }
         }
         poset.clear();
+        accMap.clear();
     }
 
     public void finalize() {