What’s Vulnerable › Vulnerabilities

CVE-2026-16243: Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-125

Description

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

Affected products

• Eclipse Foundation Eclipse OMR: from 0.1.0 through 0.10.0

References

• https://github.com/eclipse-omr/omr/pull/8348
• https://github.com/eclipse-omr/omr/pull/8349
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/195

Get alerted when CVE-2026-16243 or the next vulnerability affects your stack