Access control flaw in Eclipse OMR
Priority LOW 34CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264 and CWE-427.
Summary
Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
Why it matters now
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed Eclipse OMR (The Eclipse Foundation): 0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse OMR | before 0.1 | 0.1 | Patch available | CNA |
- Eclipse OMR VendorEclipse Foundation Affected before 0.1 Fixed in 0.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* | before 0.1 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* Versions before 0.1 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse OMR (The Eclipse Foundation) Fixed in 0.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Eclipse Foundation Eclipse OMR 0.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-08831 Time-of-check time-of-use race condition in Eclipse OMRPriority LOW 34
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11773
- 2026-10-03 Alias added: GHSA-hff7-qmcr-8mx9
References
More Eclipse Foundation Omr vulnerabilities
- TI-2026-00915 Buffer overflow in Eclipse OMR CVSS 4.0MEDIUM 6.9
- TI-2025-13291 OMR on Z processors Exposing a possible buffer over-read problem CVSS 4.0MEDIUM 6.9
- TI-2019-08831 Time-of-check time-of-use race condition in Eclipse OMR CVSS 3.1HIGH 7.4
- TI-2025-01264 Eclipse OMR: Buffer overflow vulnerability CVSS 4.0HIGH 7.1
- TI-2026-13582 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero CVSS 4.0MEDIUM 5.7
- TI-2025-01263 Eclipse OMR: Null pointer dereference vulnerability CVSS 4.0MEDIUM 5.1
Sources
- CVE-2019-11773 · CVE Program
- CVE-2019-11773 · NVD
- FIRST EPSS
- GHSA-hff7-qmcr-8mx9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences