CVE-2026-16243: Eclipse OMR Buffer Overflow Vulnerability

CVE-2026-16243 Overview

CVE-2026-16243 affects Eclipse OMR versions up to 0.11. The arraycmp Single Instruction Multiple Data (SIMD) implementation for the Z (IBM z/Architecture) and P (Power) platforms fails to validate whether the byte comparison length is zero. When the length parameter equals zero, the SIMD code path proceeds with the comparison, triggering an out-of-bounds read condition [CWE-125]. Eclipse OMR provides core runtime technologies used by language runtimes such as OpenJ9. Applications compiled with OMR-generated code on affected architectures may leak memory contents or crash when the flawed instruction sequence executes on adversary-influenced inputs.

Critical Impact
An out-of-bounds read in the arraycmp SIMD path on Z and P architectures can crash processes or expose adjacent memory contents when the compare length is zero.

Affected Products

Eclipse OMR versions up to and including 0.11
OMR arraycmp SIMD code path on IBM Z (z/Architecture)
OMR arraycmp SIMD code path on IBM Power (P) architecture

Discovery Timeline

2026-07-21 - CVE-2026-16243 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16243

Vulnerability Analysis

Eclipse OMR implements arraycmp as an optimized SIMD routine that compares two byte arrays for equality on IBM Z and Power platforms. The routine accepts a length parameter that specifies how many bytes to compare. The implementation omits a guard clause for the zero-length case. When callers invoke the routine with a length of zero, the SIMD vector load and compare instructions still execute against the supplied pointers.

This produces an out-of-bounds read of memory that the caller did not intend to access. The read can span into adjacent pages, unmapped memory, or sensitive data belonging to other allocations within the same process.

Exploitation depends on reaching the flawed code path through a runtime that generates or dispatches to the vulnerable SIMD sequence. Successful triggering results in a denial of service through process termination, or partial information disclosure through side-channel observation of the read behavior. The Common Weakness Enumeration classification is [CWE-125] Out-of-bounds Read.

Root Cause

The root cause is a missing length check in the SIMD arraycmp implementation for Z and P targets. The scalar fallback handles the zero-length case correctly by returning immediately, but the vectorized path assumes a positive length and executes at least one vector load. The absence of an early-exit branch causes the routine to dereference the input pointers regardless of whether any comparison is required.

Attack Vector

The attack vector is network-adjacent through applications that pass attacker-influenced length values into an OMR-based runtime. High attack complexity applies because the adversary must control the length argument and reach the SIMD dispatch path on a Z or P host. User interaction is required, and privileges are limited to those already held by the calling process. Availability impact is high because a crash terminates the runtime. See the fixes in GitHub Pull Request #8348 and GitHub Pull Request #8349 for the corrected boundary handling.

Detection Methods for CVE-2026-16243

Indicators of Compromise

Unexpected crashes or segmentation faults in OMR-based runtimes on IBM Z or Power hosts
Core dumps referencing arraycmp frames in the OMR code cache or JIT-compiled methods
Access violations logged against unmapped memory pages during array comparison operations

Detection Strategies

Inventory hosts running OpenJ9 or other OMR-derived runtimes on Z and P architectures and cross-reference against OMR version 0.11 or earlier
Enable runtime crash reporting and forward core dump metadata to a central logging system for pattern analysis
Monitor build pipelines and container images for embedded OMR versions using software composition analysis

Monitoring Recommendations

Alert on repeated process restarts of Java Virtual Machines or other OMR-linked services on Z and P hosts
Track signal termination events (SIGSEGV, SIGBUS) in system logs and correlate with recent input changes
Ingest kernel audit records for memory faults into a centralized data lake for retrospective analysis

How to Mitigate CVE-2026-16243

Immediate Actions Required

Identify all deployments of Eclipse OMR version 0.11 or earlier on IBM Z and Power hardware
Upgrade to a patched OMR build that incorporates the fixes from pull requests #8348 and #8349
Rebuild and redeploy downstream runtimes such as OpenJ9 against the patched OMR sources

Patch Information

The upstream fixes are tracked in GitHub Pull Request #8348 and GitHub Pull Request #8349. Coordination details are recorded in the GitLab CVE Assignment #195. Both pull requests add a zero-length guard to the arraycmp SIMD implementations for Z and P respectively, ensuring the routine returns immediately when the byte count is zero.

Workarounds

Restrict untrusted input from reaching code paths that invoke OMR arraycmp with caller-controlled length values
Where feasible, disable SIMD acceleration for arraycmp in OMR configuration to force use of the scalar fallback path
Isolate affected workloads on Z and P hosts behind input validation layers until patched builds are deployed

bash

# Verify installed OMR version in an OpenJ9-based JDK
java -version 2>&1 | grep -i omr

# Rebuild OMR from patched sources
git clone https://github.com/eclipse-omr/omr.git
cd omr
git checkout main   # ensure PR #8348 and #8349 are merged
cmake -Bbuild -H.
cmake --build build