Eclipse OMR: Buffer overflow vulnerability
Priority LOW 32CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized correctly and checked appropriately to prevent buffer overflows.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed Eclipse OMR (Eclipse Foundation): 0.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse OMR | 0.2.0 to before 0.4.0 | 0.4.0 | Patch available | CNA |
- Eclipse OMR VendorEclipse Foundation Affected 0.2.0 to before 0.4.0 Fixed in 0.4.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* | 0.2.0 – 0.4.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* Versions 0.2.0 – 0.4.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse OMR (Eclipse Foundation) Fixed in 0.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1471
- 2026-10-03 Alias added: GHSA-w5mv-5x6q-jgmp
References
More Eclipse Foundation Omr vulnerabilities
- TI-2026-00915 Buffer overflow in Eclipse OMR CVSS 4.0MEDIUM 6.9
- TI-2025-13291 OMR on Z processors Exposing a possible buffer over-read problem CVSS 4.0MEDIUM 6.9
- TI-2019-08831 Time-of-check time-of-use race condition in Eclipse OMR CVSS 3.1HIGH 7.4
- TI-2019-08830 Access control flaw in Eclipse OMR CVSS 3.1HIGH 7.8
- TI-2026-13582 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero CVSS 4.0MEDIUM 5.7
- TI-2025-01263 Eclipse OMR: Null pointer dereference vulnerability CVSS 4.0MEDIUM 5.1
Sources
- CVE-2025-1471 · CVE Program
- CVE-2025-1471 · NVD
- FIRST EPSS
- GHSA-w5mv-5x6q-jgmp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences