CVE-2026-16441: Eclipse OpenJ9 RCE Vulnerability

CVE-2026-16441 Overview

CVE-2026-16441 is a medium-severity vulnerability in Eclipse OpenJ9 versions up to 0.60. The flaw affects how the Java Virtual Machine (JVM) dispatches method calls when a previously concrete superclass method has been recompiled as abstract. Under these conditions, OpenJ9 incorrectly delegates execution to an interface default method instead of raising the expected error.

The issue is classified under [CWE-758] (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior). It can lead to integrity violations in Java applications that depend on strict method resolution semantics.

Critical Impact
Incorrect method dispatch can cause Java applications to execute unintended interface default methods, bypassing expected class hierarchy behavior and potentially compromising integrity.

Affected Products

Eclipse OpenJ9 versions up to and including 0.60
Java runtime environments built on Eclipse OpenJ9
IBM Semeru Runtime distributions bundling OpenJ9 up to 0.60

Discovery Timeline

2026-07-21 - CVE-2026-16441 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16441

Vulnerability Analysis

CVE-2026-16441 originates in the method dispatch logic of Eclipse OpenJ9. When a class hierarchy contains a concrete superclass method that gets recompiled as abstract, the JVM should either invoke the correct overriding implementation or throw an AbstractMethodError. OpenJ9 instead resolves the call to an interface default method that happens to match the signature.

This breaks the Java Language Specification's method resolution order. Applications relying on the abstract contract to enforce subclass responsibilities can silently execute unintended logic. The result is a class integrity violation without any warning to the calling code.

Root Cause

The root cause is an incorrect implementation of the JVM method resolution algorithm in OpenJ9. When a superclass method transitions from concrete to abstract through recompilation, the runtime's cached dispatch tables do not correctly reflect the new state. The dispatcher falls back to interface default methods rather than following the specified resolution order defined for invokevirtual and invokeinterface bytecodes.

Attack Vector

Exploitation requires an attacker to influence class files loaded by a target OpenJ9 runtime. The attacker must supply or modify classes so that a superclass method previously implemented concretely is redefined as abstract, while an interface default method with the same signature exists. User interaction is required and attack complexity is high, which limits practical exploitation.

Successful exploitation results in the JVM executing attacker-influenced interface default methods when application code expected an abstract method contract. The impact is primarily integrity of executed code paths, with limited availability effects. No verified proof-of-concept code is publicly available.

Refer to the Eclipse OpenJ9 GitHub Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-16441

Indicators of Compromise

Unexpected invocations of interface default methods where an AbstractMethodError was previously expected
Application logs showing behavioral divergence after upgrading or hot-swapping class files on OpenJ9 runtimes at version 0.60 or earlier
Class files where a superclass method signature has transitioned from concrete to abstract while an implementing interface exposes a matching default method

Detection Strategies

Inventory JVM installations and identify hosts running Eclipse OpenJ9 versions up to 0.60 using software asset management data
Enable JVM verbose class loading (-verbose:class) on non-production instances to observe class redefinition events and detect abnormal dispatch paths
Perform static analysis of application bytecode to identify class hierarchies that combine abstract superclass methods with matching interface default methods

Monitoring Recommendations

Monitor application error rates for suppressed AbstractMethodError occurrences or unexplained behavioral drift after class reloads
Track OpenJ9 runtime versions across the environment and alert on hosts running versions at or below 0.60
Audit CI/CD pipelines that perform class recompilation or hot deployment against OpenJ9 targets

How to Mitigate CVE-2026-16441

Immediate Actions Required

Identify all systems running Eclipse OpenJ9 at version 0.60 or earlier and prioritize them for remediation
Upgrade Eclipse OpenJ9 to a fixed release beyond 0.60 as published by the OpenJ9 project
Restrict the ability of untrusted users to supply or modify class files loaded into shared JVM instances
Review class hierarchies that mix abstract superclass methods with interface default methods for behavioral correctness

Patch Information

The Eclipse OpenJ9 project has addressed the issue through code changes tracked in OpenJ9 Pull Request #24396. Coordination details are documented in the Eclipse CVE Assignment record. Administrators should deploy OpenJ9 builds that include this fix. IBM Semeru Runtime users should apply the corresponding vendor update once available.

Workarounds

Avoid runtime class redefinition or hot recompilation on OpenJ9 0.60 and earlier until the patched release is deployed
Refactor affected class hierarchies to eliminate signature collisions between abstract superclass methods and interface default methods
Where feasible, run untrusted or third-party bytecode on a JVM implementation not affected by this dispatch flaw

bash

# Verify installed OpenJ9 version
java -version

# Example output line to inspect:
# Eclipse OpenJ9 VM (build openj9-0.60.0, JRE ...)

# List JVM processes to identify OpenJ9 runtimes on a host
jps -v | grep -i openj9