CVE-2026-1188
In the Eclipse OMR port library component since release 0.2.0, an API function to return the...
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
- Record
CVE-2026-1188- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L - Weakness
- CWE-131
- Updated
- 2026-11-02
EUVDEUVD-2026-4991
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
- Record
EUVD-2026-4991- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x24c-w26v-w8jg
In the Eclipse OMR port library component since release 0.2.0, an API function to return the...
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
- Record
GHSA-x24c-w26v-w8jg- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120, CWE-131
- Updated
- 2026-11-02
NVD
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
- Record
CVE-2026-1188- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-131, CWE-120
- Updated
- 2026-11-02
OSV
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
- Record
CVE-2026-1188- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L - Weakness
- CWE-131
- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10788-1 No score
java-11-openj9-11.0.31.0-2.1 on GA media
These are all security issues fixed in the java-11-openj9-11.0.31.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10788-1- Updated
- 2026-11-02
Show 9 moreShow less
OSVopenSUSE-SU-2026:10789-1 No score
java-17-openj9-17.0.19.0-2.1 on GA media
These are all security issues fixed in the java-17-openj9-17.0.19.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10789-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10790-1 No score
java-1_8_0-openj9-1.8.0.492-2.1 on GA media
These are all security issues fixed in the java-1_8_0-openj9-1.8.0.492-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10790-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10791-1 No score
java-21-openj9-21.0.11.0-2.1 on GA media
These are all security issues fixed in the java-21-openj9-21.0.11.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10791-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10792-1 No score
java-25-openj9-25.0.3.0-2.1 on GA media
These are all security issues fixed in the java-25-openj9-25.0.3.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10792-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20943-1 No score
Security update for java-17-openj9
This update for java-17-openj9 fixes the following issues:
Changes in java-17-openj9:
-
Make post scripts less noisy (bsc#1267355)
-
Use libalternatives instead of update-alternatives for distributions where libalternatives is available
-
Update to OpenJDK 17.0.19 with OpenJ9 0.59.0 virtual machine
-
Including Oracle April 2026 CPU changes
- CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494), CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496), CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118), CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)
-
OpenJ9 specific security fix
- CVE-2026-1188 (bsc#1265261)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.59/
-
Update to OpenJDK 17.0.18 with OpenJ9 0.57.0 virtual machine
-
Including Oracle January 2026 CPU changes
- CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036), CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.57/
-
Do not depend on update-desktop-files (jsc#PED-14507)
-
Update to OpenJDK 17.0.17 with OpenJ9 0.56.0 virtual machine
-
Including Oracle October 2025 CPU changes
- CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.56/
-
Update to OpenJDK 17.0.16 with OpenJ9 0.53.0 virtual machine
-
Including Oracle July 2025 CPU changes
- CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598), CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.53/
-
Enable bootcycle build
-
Do not embed rebuild counter (bsc#1246806)
-
Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since the C++ part is on -std=gnu++98, this is the closest.
-
Added patch:
- fix-build-with-gcc15.patch
- fix a typo in omr that is fatal with gcc15
- fix-build-with-gcc15.patch
-
Update to OpenJDK 17.0.15 with OpenJ9 0.51.0 virtual machine
-
Including Oracle April 2025 CPU changes
- CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275), CVE-2025-30698 (bsc#1241276)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.51/
-
fix wrong execstack flag in libj9jit (bsc#1235844)
-
Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine
-
Including Oracle October 2024 and January 2025 CPU changes
- CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711), CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719), CVE-2025-21502 (bsc#1236278)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/
- Record
openSUSE-SU-2026:20943-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20947-1 No score
Security update for java-21-openj9
This update for java-21-openj9 fixes the following issues:
Changes in java-21-openj9:
-
Make post scripts less noisy (bsc#1267355)
-
Use libalternatives instead of update-alternatives for distributions where libalternatives is available
-
Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine
-
Including Oracle April 2026 CPU changes
- CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494), CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496), CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118), CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)
-
OpenJ9 specific security fix
- CVE-2026-1188 (bsc#1265261)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.59/
-
Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine
-
Including Oracle January 2026 CPU changes
- CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036), CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.57/
-
Do not depend on update-desktop-files (jsc#PED-14507)
-
Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine
-
Including Oracle October 2025 CPU changes
- CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417), CVE-2025-61748 (bsc#1252418)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.56/
-
Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine
-
Including Oracle July 2025 CPU changes
- CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598), CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.53/
-
Enable bootcycle build
-
Do not embed rebuild counter (bsc#1246806)
-
Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since the C++ part is on -std=gnu++98, this is the closest.
-
Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine
-
Including Oracle April 2025 CPU changes
- CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275), CVE-2025-30698 (bsc#1241276)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.51/
-
fix wrong execstack flag in libj9jit (bsc#1235844)
-
Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine
-
Including Oracle October 2024 and January 2025 CPU changes
- CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711), CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719), CVE-2025-21502 (bsc#1236278)
- OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/
- Record
openSUSE-SU-2026:20947-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2036-1 No score
Security update for java-1_8_0-openj9
This update for java-1_8_0-openj9 fixes the following issues
- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261).
- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).
- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).
- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).
- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).
Changes for java-1_8_0-openj9:
- Update to OpenJDK 8u492 build 09 with OpenJ9 0.59.0 virtual machine
- Record
SUSE-SU-2026:2036-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2110-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues
- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).
- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).
- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).
- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261)
Changes for java-1_8_0-ibm:
- Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)
- Record
SUSE-SU-2026:2110-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2453-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues
- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).
- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).
- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).
- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261)
Changes for java-1_8_0-ibm:
- Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)
- Record
SUSE-SU-2026:2453-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 7 CVEs |
before 1.8.0_sr8.65-30.150.1 | 1.8.0_sr8.65-30.150.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 7 CVEs |
before 1.8.0_sr8.65-30.150.1 | 1.8.0_sr8.65-30.150.1 |
java-11-openj9openSUSE:Tumbleweed |
before 11.0.31.0-2.1 | 11.0.31.0-2.1 |
java-17-openj9openSUSE:Tumbleweed |
before 17.0.19.0-2.1 | 17.0.19.0-2.1 |
java-1_8_0-openj9openSUSE:Tumbleweed |
before 1.8.0.492-2.1 | 1.8.0.492-2.1 |
java-21-openj9openSUSE:Tumbleweed |
before 21.0.11.0-2.1 | 21.0.11.0-2.1 |
java-25-openj9openSUSE:Tumbleweed |
before 25.0.3.0-2.1 | 25.0.3.0-2.1 |
java-17-openj9openSUSE:Leap 16.0 From an advisory covering 27 CVEs |
before 17.0.19.0-bp160.1.1 | 17.0.19.0-bp160.1.1 |
java-21-openj9openSUSE:Leap 16.0 From an advisory covering 28 CVEs |
before 21.0.11.0-bp160.1.1 | 21.0.11.0-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-1188 is a medium vulnerability (CVSS 6.9) in Eclipse Omr, published January 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in java-11-openj9 11.0.31.0-2.1.
References
github.com/eclipse-omr/omr/pull/8082
nvd.nist.gov/vuln/detail/CVE-2026-1188
suse.com/support/update/announcement/2026/suse-su-20262036-1
Show 63 moreShow less
bugzilla.suse.com/1259118