Eclipse OMR CVE-2026-16243

Exploitation is strictly limited to systems running on IBM Z (s390x) or IBM POWER (P10) hardware - the vulnerable SIMD code paths do not exist in x86 or ARM builds of Eclipse OMR, making the entire x86 ecosystem immune. The JIT compiler must be active (interpreted mode via -Xint removes the risk). A low-privileged attacker must be able to supply inputs that trigger a zero-length array comparison in a JIT-compiled hot method, and active user interaction is required (CVSS UI:A). High attack complexity (AC:H) and the AT:P prerequisite (specific architectural target) further limit opportunistic or automated exploitation. Exploitation is not feasible against default configurations on non-IBM architectures, and even on affected architectures, the attacker must navigate JIT compilation thresholds and specific call-site conditions to reach the vulnerable path.

The CVSS 4.0 score of 5.7 (Medium) accurately captures the constrained exploitation surface. AV:N indicates the vulnerable path can be reached through network-delivered application inputs, but AC:H and AT:P (Attack Target Presence) confirm that specific architectural and runtime prerequisites must be satisfied: the target must run on IBM Z or IBM POWER hardware with JIT compilation active. PR:L and UI:A further limit exploitation to low-privilege authenticated contexts requiring active user participation. The primary impact, VA:H, is a JVM crash causing availability loss; VC:N and VI:N confirm no confidentiality or integrity impact is assessed at the vulnerable-system level, though the 'Information Disclosure' metadata tag suggests a secondary minor read-past-bounds data exposure risk that the CVSS does not elevate. No EPSS score was provided in the input data, and the absence of KEV listing and PoC confirms this is a theoretical risk without observed in-the-wild exploitation. The vulnerability is a real concern for IBM Z and POWER workloads running OpenJ9-based JVMs but represents no risk whatsoever on x86 infrastructure.

An attacker who can deliver crafted inputs to a Java application running on Eclipse OpenJ9 or IBM Semeru Runtime on IBM Z or POWER hardware submits data that causes a hot code path to invoke a zero-length array comparison. Once the JIT compiler generates and executes the flawed SIMD arraycmp instruction sequence, an out-of-bounds memory read occurs, crashing the JVM process and causing a denial of service. No public proof-of-concept exploit code has been identified at time of analysis.