Is CVE-2026-16243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16243 being exploited in the wild.

How severe is CVE-2026-16243?

Informational severity, with a CVSS score of 5.7, published 21 July 2026.

Which products and versions are affected?

Eclipse Foundation OMR 0.1 to 0.11.

Is there a fix for CVE-2026-16243?

A patch was published on 2026-07-20: Fixes merged in GitHub pull requests 8348 and 8349. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16243 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16243?

Check whether you run Eclipse Foundation OMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16243: Eclipse OMR out-of-bounds read in arraycmp SIMD implementation

CVE-2026-16243 · Severity: info · CVSS 5.7 · Published 2026-07-21

Eclipse OMR, a toolkit for building language runtimes, contains a flaw in how it compares data arrays on IBM Z and Power architectures. When a program attempts to compare two empty (zero-length) arrays, the system may incorrectly process the request, leading to unexpected results or potential service instability. This could allow an attacker with limited access to trigger a crash or disrupt operations in applications built using this toolkit.

Vendors: Eclipse Foundation.

Quick answers

Is CVE-2026-16243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16243 being exploited in the wild.
How severe is CVE-2026-16243?: Informational severity, with a CVSS score of 5.7, published 21 July 2026.
Which products and versions are affected?: Eclipse Foundation OMR 0.1 to 0.11.
Is there a fix for CVE-2026-16243?: A patch was published on 2026-07-20: Fixes merged in GitHub pull requests 8348 and 8349. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16243 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16243?: Check whether you run Eclipse Foundation OMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read (CWE-125) exists in the Eclipse OMR compiler's SIMD implementation of the 'arraycmp' and 'arraycmplen' opcodes for IBM Z (S390) and Power architectures. The root cause is a missing check for zero-length comparisons; when the comparison length is zero, the evaluator still enters the comparison loop, leading to inconsistent results or memory access issues. On IBM Z, this specifically affects the SIMD evaluator, while on Power, it results in inconsistent handling of zero-length data. An attacker could potentially exploit this to cause a denial-of-service (DoS) or influence application logic. The issue is addressed in Eclipse OMR version 0.11 and later via pull requests #8348 and #8349.

Affected products

Eclipse Foundation Eclipse OMR 0.1 to 0.11

Timeline

2026-07-20: patched: Fixes merged in GitHub pull requests 8348 and 8349.
2026-07-21: advisory: CVE-2026-16243 published by NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.