5.7Medium
CVE-2026-16243Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
Description
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.
Weakness (CWE):
CWE-125
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Eclipse Foundation | Eclipse OMR | 0.1 – < 0.11, fixed 0.11 | |
| eclipse | omr | 0.1.0 – ≤ 0.10.0 |
References and patches
- https://github.com/eclipse-omr/omr/pull/8349 Issue TrackingPatch
- https://github.com/eclipse-omr/omr/pull/8348 Issue TrackingPatch
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/195 Broken Link
CPE matches (NVD) (1)
cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:*≥ 0.1.0 ≤ 0.10.0