Executive brief
Eclipse OpenJ9 is a high-performance Java Virtual Machine (JVM) used to run Java applications. A vulnerability in how the JVM handles specific code changes could allow an attacker to bypass intended access restrictions, potentially leading to unauthorized data modification or system instability. This occurs when the software incorrectly executes code from an interface instead of throwing a standard error when a parent class method is changed.
Technical details
A vulnerability exists in Eclipse OpenJ9 versions 0.8.0 through 0.59.9 related to the handling of 'invokeinterface' instructions. When a concrete superclass method is recompiled as abstract, the JVM incorrectly delegates execution to an interface default method instead of throwing the expected IllegalAccessError or AbstractMethodError. This occurs because the 'throwUnsatisfiedLinkOrAbstractMethodError' logic incorrectly assumed it would always be passed an abstract interface method. An attacker could potentially exploit this implementation-defined behavior (CWE-758) to execute unintended code paths. The issue is resolved in version 0.60.0.
Affected products
- Eclipse Foundation OpenJ9 0.8.0 to 0.59.9
Timeline
- 2026-07-21: advisory
- 2026-07-21: disclosed
- 2026-07-21: patched