EUVD-2026-46338
GHSA-pw53-4wcc-wm6v
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N for network-reachable JVM applications; AC:H and UI:R because -Xtrace with method tracing must be explicitly operator-enabled; PR:L for method invocation; no confidentiality impact.
AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.
AnalysisAI
Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.
Technical ContextAI
Eclipse OpenJ9 (CPE: cpe:2.3:a:eclipse_foundation:openj9:*:*:*:*:*:*:*:*) is an alternative JVM implementation originally developed by IBM and contributed to the Eclipse Foundation, now distributed as part of IBM Semeru Runtime. The vulnerability (CWE-124: Buffer Underwrite / Buffer Underflow) exists in the method argument tracing facility, activated by the -Xtrace JVM startup option. The affected code in runtime/rastrace/method_trace.c, function traceMethodArguments(), unconditionally decremented the cursor pointer three times to write the characters '.' '.' '.' as a truncation indicator when the trace buffer was full. Because no bounds check confirmed the cursor was at least 3 bytes beyond the buffer start (buf), the cursor could advance before buf, causing writes to memory preceding the allocated buffer region - a textbook buffer underwrite that can corrupt adjacent heap or stack memory depending on allocation context.
RemediationAI
The upstream fix is available as GitHub PR #24394 (https://github.com/eclipse-openj9/openj9/pull/24394), which adds a conditional check ensuring the cursor is at least 3 bytes beyond the buffer start before writing the ellipsis, and an additional guard (cursor > buf) on the else branch. A specific tagged release version containing this fix was not confirmed from available references - monitor official Eclipse OpenJ9 release notes and IBM Semeru Runtime security advisories for the versioned patch and upgrade to the first release above 0.60 that includes PR #24394. As an immediate compensating control with no impact on normal JVM operation, remove the -Xtrace flag from all production JVM startup configurations where it is not strictly necessary; this eliminates the attack surface entirely. If -Xtrace is required for active diagnostics, restrict its use to isolated, non-internet-facing JVM instances and terminate tracing sessions promptly after use.
In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to
In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inacces
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byt
In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are
AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege eleva
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Ec
In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past th
All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is
In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScaveng
In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by m
Incorrect interface method dispatch in Eclipse OpenJ9 up to version 0.60 causes the JVM to silently execute an unintende
Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today