CVE-2026-1188

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-29 · updated 2026-06-17
Weakness: CWE-131

Description

In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.

Affected products

Eclipse Foundation Eclipse OMR: from 0.2 before 0.8.0 — fixed in 0.8.0

How to fix

Upgrade to a fixed version: Eclipse Foundation Eclipse OMR 0.8.0. Check the vendor advisory for mitigations.

References

https://github.com/eclipse-omr/omr/pull/8082

Get alerted when CVE-2026-1188 or the next vulnerability affects your stack