Executive brief
Eclipse OpenJ9, a high-performance Java virtual machine, contains a memory corruption vulnerability when specific diagnostic tracing features are enabled. If an administrator uses the method argument tracing tool, a technical flaw can cause the system to write data to the wrong memory location. This could potentially lead to application crashes or allow an attacker to disrupt normal operations and compromise the integrity of the running service.
Technical details
A buffer underwrite (CWE-124) exists in the traceMethodArguments implementation of Eclipse OpenJ9. When the -Xtrace diagnostic flag is used to capture method arguments, a corner case involving methods with zero arguments causes a null byte to be written to a memory address immediately preceding the allocated buffer. This memory corruption requires the -Xtrace feature to be active and typically involves network-based triggers with low privileges and user interaction. The issue is resolved in version 0.60.0.
Affected products
- Eclipse Foundation OpenJ9 0.8.0 to 0.59.x (less than 0.60.0)
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 0.60.0 via PR 24394
- 2026-07-21: advisory