CVE-2026-1188
Reported by eclipse · Published January 29, 2026
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openjdk-8-openj9 | Chainguard | 0.57.0-r0 |
| openjdk-17-openj9 | Chainguard | 0.57.0-r0 |
| openjdk-25-openj9 | Chainguard | 0.57.0-r0 |
| openjdk-21-openj9 | Chainguard | 0.57.0-r0 |
| openjdk-11-openj9 | Chainguard | 0.57.0-r0 |
| omr | eclipse | 0.8.0 |
| Eclipse OMR | Eclipse Foundation | 0.8.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse OMR | 0.2.0 |
| Eclipse Foundation | Eclipse OMR | 0.2.0 |
Timeline
- Jan 29, 2026 EPSS Score (30 in total, the first dated here)
- Jan 29, 2026 CVE Published
- Jan 29, 2026 PoC Published (6 in total, the first dated here)
- Feb 9, 2026 CVE Updated
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
- Jun 2, 2026 Security Advisory (2 in total, the first dated here)
- Aug 11, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-1188
vulnetix vdb fixes CVE-2026-1188Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-1188/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart