Skip to content
Fencer Vulns
critical 9.8

CVE-2026-1188 json

In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor featu…

published 2026-01-29 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4991

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.

Patch / fix

  • Eclipse Foundation Eclipse OMR 0.8.0
  • java-1_8_0-ibm SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.8.0_sr8.65-30.150.1

suse advisories SUSE-SU-2026:2453-1

  • java-21-openj9 openSUSE Leap 16.0 21.0.11.0-bp160.1.1
  • java-17-openj9 openSUSE Leap 16.0 17.0.19.0-bp160.1.1
  • java-11-openj9 openSUSE Tumbleweed 11.0.31.0-2.1
  • java-17-openj9 openSUSE Tumbleweed 17.0.19.0-2.1
  • java-1_8_0-openj9 openSUSE Tumbleweed 1.8.0.492-2.1
  • java-21-openj9 openSUSE Tumbleweed 21.0.11.0-2.1
  • java-25-openj9 openSUSE Tumbleweed 25.0.3.0-2.1

opensuse advisories openSUSE-SU-2026:20947-1openSUSE-SU-2026:20943-1openSUSE-SU-2026:10788-1openSUSE-SU-2026:10789-1openSUSE-SU-2026:10790-1openSUSE-SU-2026:10791-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Eclipse Foundation Eclipse OMR

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.