What’s Vulnerable › Vulnerabilities

CVE-2026-111075: JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-26
• Weakness: CWE-125

Description

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.

Affected products

• The Eclipse Foundation Eclipse OpenJ9: from 0.8.0 before 0.63 — fixed in 0.63

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse OpenJ9 0.63. Check the vendor advisory for mitigations.

References

• https://github.com/eclipse-openj9/openj9/pull/25009
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/423
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/941

Get alerted when CVE-2026-111075 or the next vulnerability affects your stack