Skip to main content

Eclipse OMR CVE-2026-16243

| EUVDEUVD-2026-46347 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-21 eclipse GHSA-c5v6-97gv-39fw
Buffer Overflow Information Disclosure Eclipse Omr Eclipse Foundation
5.7
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
5.7 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

Network-reachable JVM application on IBM Z/POWER required (AV:N/AC:H); low-privilege trigger with user interaction (PR:L/UI:R); scope unchanged, no confidentiality or integrity impact, high availability impact from JVM crash.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Red Hat
4.8 MEDIUM
qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
A
Scope
X

Lifecycle Timeline

3
Patch available
Jul 21, 2026 - 19:03 EUVD
Source Code Evidence Fetched
Jul 21, 2026 - 18:34 vuln.today
Analysis Generated
Jul 21, 2026 - 18:34 vuln.today

DescriptionCVE.org

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

AnalysisAI

Out-of-bounds read in Eclipse OMR's arraycmp SIMD JIT implementation for IBM Z (s390x) and IBM POWER (P10) architectures - versions up to 0.11 - allows a low-privileged network-reachable attacker to trigger an application crash when a zero-length array comparison is JIT-compiled and executed. The flaw exists exclusively in the SIMD code-generation paths for these two architectures and has no impact on x86 or ARM deployments. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis; exploitation is further constrained by high attack complexity and the requirement for user interaction.

Technical ContextAI

Eclipse OMR is an open-source JVM infrastructure toolkit that forms the compiler and runtime foundation for Eclipse OpenJ9 and IBM Semeru Runtime. The vulnerability resides in the JIT compiler's SIMD array-comparison code generation within compiler/p/codegen/OMRTreeEvaluator.cpp, specifically in the inlineArrayCmp and inlineArrayCmpP10 functions. CWE-125 (Out-of-bounds Read) describes the root cause: when arraycmp is invoked with a byte-count of zero, neither the Z nor P SIMD implementation short-circuits before entering the comparison loop. The code instead proceeds to execute SIMD memory-load instructions against potentially invalid bounds. The GitHub PR #8349 fix for POWER adds an explicit AND-instruction zero-check with a conditional branch-if-equal to a returnTrueLabel before the comparison loop, and also fixes premature NULL register allocations (condReg/condReg2 now allocated before use, resultLabel generated at function entry). PR #8348 applies an equivalent fix for the Z architecture. CPE: cpe:2.3:a:eclipse_foundation:eclipse_omr:*:*:*:*:*:*:*:* through version 0.11.

RemediationAI

Upstream fixes are available via GitHub pull request #8349 (POWER/P10 architecture: https://github.com/eclipse-omr/omr/pull/8349) and pull request #8348 (Z architecture: https://github.com/eclipse-omr/omr/pull/8348); however, a specific patched release version of Eclipse OMR has not been independently confirmed from the available data - these are upstream PR merges, not a tagged release. Organizations should monitor the Eclipse OMR project releases and the security advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/195 for an official patched version. As a compensating control on IBM Z or POWER deployments, disabling JIT compilation by passing -Xint to OpenJ9 or IBM Semeru Runtime eliminates the vulnerable SIMD code-generation path entirely, though this incurs severe throughput penalties (typically 5-10x slower execution). Alternatively, application-layer validation to prevent zero-length array comparison calls on hot paths reduces exposure without JIT overhead, but requires code changes to dependent applications.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise Module for Legacy 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-16243 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy