Eclipse OMR CVE-2025-14549

Exploitation requires all of the following concrete conditions: the target must run Eclipse OpenJ9 as a consumer of Eclipse OMR version 0.7.0 or later; it must execute on IBM Z (s390x) processors, since the faulty optimization is enabled only there; and attacker-influenced data must pass through the Latin-compatible-charset (UTF-8, ISO8859-1, ASCII) to IBM-1047/037 EBCDIC translation sequence while containing at least one NUL (0x00) byte, which is what triggers the output truncation and subsequent buffer over-read. Limiting factors that reduce realistic risk: non-Z platforms are unaffected, non-OpenJ9 OMR consumers may not hit this path, and impact is bounded to limited memory over-read (information disclosure / instability) rather than code execution; authentication requirements are not independently confirmed beyond the vendor's PR:N claim.

This is a moderate, not top-tier, priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates every impact dimension as Low (VC:L/VI:L/VA:L) for a base score of 6.9, which is consistent with a CWE-125 out-of-bounds read: the primary consequence is limited information disclosure and possible instability, not full compromise. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis - the only code artifact supplied is the vendor fix (PR 8073), not a weaponized POC. The network attack vector is plausible because untrusted data can reach the vulnerable charset-translation path, but real-world reachability is heavily gated by preconditions the raw CVSS score does not capture: the defect only manifests in Eclipse OpenJ9 consumers of OMR running on IBM Z (s390x) processors with the specific array-translate optimization enabled. One signal to reconcile explicitly: the CVSS vector asserts AV:N/PR:N (remote, unauthenticated), yet the bug is a compiler-optimization flaw triggered by specific data content (NUL bytes in a Latin-to-IBM-1047/037 translation), so exploitability depends far more on whether attacker-influenced data flows through that path than on network position - verify data-flow exposure in your deployment rather than treating it as trivially remote.

An attacker supplies input containing an embedded NUL (0x00) byte to an application running on Eclipse OpenJ9 on an IBM Z system, where that input is converted from a Latin-compatible charset (UTF-8/ISO8859-1/ASCII) to IBM-1047/037 EBCDIC. The optimized translation truncates the output at the NUL and triggers a buffer over-read, potentially leaking adjacent heap memory into the result or destabilizing the process. No public exploit code exists; this is an inferred scenario grounded in the CWE-125 over-read described in the advisory.