Eclipse OMR: Null pointer dereference vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. This can lead to NULL pointer dereference crashes. Beginning in version 0.5.0, internal OMR consumers of atoe functions handle NULL return values and memory allocation failures correctly.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse OMR | up to 0.4.0 | — | No fix listed | CNA |
- Eclipse OMR VendorEclipse Foundation Affected up to 0.4.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* | up to 0.4.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* Versions up to 0.4.0 Vulnerable ·Eclipse Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1470
- 2026-10-03 Alias added: GHSA-pvp4-8q5g-43fg
References
More Eclipse Foundation Omr vulnerabilities
- TI-2026-00915 Buffer overflow in Eclipse OMR CVSS 4.0MEDIUM 6.9
- TI-2025-13291 OMR on Z processors Exposing a possible buffer over-read problem CVSS 4.0MEDIUM 6.9
- TI-2019-08831 Time-of-check time-of-use race condition in Eclipse OMR CVSS 3.1HIGH 7.4
- TI-2019-08830 Access control flaw in Eclipse OMR CVSS 3.1HIGH 7.8
- TI-2025-01264 Eclipse OMR: Buffer overflow vulnerability CVSS 4.0HIGH 7.1
- TI-2026-13582 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero CVSS 4.0MEDIUM 5.7
Sources
- CVE-2025-1470 · CVE Program
- CVE-2025-1470 · NVD
- FIRST EPSS
- GHSA-pvp4-8q5g-43fg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences