Executive brief
Eclipse OMR, a toolkit for building language runtimes, contains a flaw in how it compares data arrays on IBM Z and Power architectures. When a program attempts to compare two empty (zero-length) arrays, the system may incorrectly process the request, leading to unexpected results or potential service instability. This could allow an attacker with limited access to trigger a crash or disrupt operations in applications built using this toolkit.
Technical details
An out-of-bounds read (CWE-125) exists in the Eclipse OMR compiler's SIMD implementation of the 'arraycmp' and 'arraycmplen' opcodes for IBM Z (S390) and Power architectures. The root cause is a missing check for zero-length comparisons; when the comparison length is zero, the evaluator still enters the comparison loop, leading to inconsistent results or memory access issues. On IBM Z, this specifically affects the SIMD evaluator, while on Power, it results in inconsistent handling of zero-length data. An attacker could potentially exploit this to cause a denial-of-service (DoS) or influence application logic. The issue is addressed in Eclipse OMR version 0.11 and later via pull requests #8348 and #8349.
Affected products
- Eclipse Foundation Eclipse OMR 0.1 to 0.11
Timeline
- 2026-07-20: patched: Fixes merged in GitHub pull requests 8348 and 8349.
- 2026-07-21: advisory: CVE-2026-16243 published by NVD.