Buffer overflow in Eclipse OMR
Priority LOW 37CWE-131Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix Fixed Eclipse OMR (Eclipse Foundation): 0.8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse OMR | 0.2.0 to before 0.8.0 | 0.8.0 | Patch available | CNA |
- Eclipse OMR VendorEclipse Foundation Affected 0.2.0 to before 0.8.0 Fixed in 0.8.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* | 0.2 to before 0.8.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:* Versions 0.2 to before 0.8.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse OMR (Eclipse Foundation) Fixed in 0.8.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1188
- 2026-10-03 Alias added: GHSA-x24c-w26v-w8jg
References
More Eclipse Foundation Omr vulnerabilities
- TI-2025-13291 OMR on Z processors Exposing a possible buffer over-read problem CVSS 4.0MEDIUM 6.9
- TI-2019-08831 Time-of-check time-of-use race condition in Eclipse OMR CVSS 3.1HIGH 7.4
- TI-2019-08830 Access control flaw in Eclipse OMR CVSS 3.1HIGH 7.8
- TI-2025-01264 Eclipse OMR: Buffer overflow vulnerability CVSS 4.0HIGH 7.1
- TI-2026-13582 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero CVSS 4.0MEDIUM 5.7
- TI-2025-01263 Eclipse OMR: Null pointer dereference vulnerability CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-1188 · CVE Program
- CVE-2026-1188 · NVD
- FIRST EPSS
- GHSA-x24c-w26v-w8jg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences