CVE Intelligence
Analysis AI-assisted

CVE-2026-1188: Eclipse OMR port library buffer overflow in processor feature name API

The Eclipse OMR port library contains a classic buffer overflow (CWE-120) in an API that returns the names of supported processor features when the caller's output buffer is undersized. NVD rates it CVSS 3.1 9.8 (critical), and the CNA rates it 6.9 under CVSS 4.0. The issue is fixed in Eclipse OMR 0.8.0, and the record does not show it in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-1188 affects the port library component of Eclipse OMR, a runtime support library. An API function that returns the textual names of all supported processor features does not account for the separator placed between entries. When the caller supplies an output buffer that is too small, the write-safety check can be wrong, which can lead to a buffer overflow.

Impact

The weakness is classified as CWE-120 (Classic Buffer Overflow). According to the description, a successful trigger could corrupt memory adjacent to the output buffer. The NVD assigns CVSS 3.1 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CNA, emo@eclipse.org, assigns 6.9 under CVSS 4.0. The sources consulted do not describe the concrete consequences in a specific deployment.

Affected products and versions

  • Product: Eclipse Omr
  • Affected range: from 0.2 up to, but not including, 0.8.0
  • The description states the component is affected since release 0.2.0.

Exploitation status

The record lists this CVE as not present in CISA KEV, and no EPSS score is provided. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Eclipse OMR to version 0.8.0 or later, which the record identifies as the fixed version.
  • Review the referenced patch in the upstream pull request and confirm that the deployed build includes it.
  • Audit local code that calls the affected processor feature name API and make sure output buffers are sized with the separator taken into account, as a defensive hardening step while upgrades are scheduled.
  • Where the library is embedded in other products, check with those vendors for their own updated builds.

Detection guidance

  • Inventory hosts and applications that bundle Eclipse OMR and record their version.
  • Flag builds older than 0.8.0 for prioritized review.
  • Monitor for abnormal crashes or memory faults in processes that load the OMR port library, as these may indicate memory corruption. This is a general signal and does not confirm exploitation.

Limitations of the available information

The sources do not state which platforms, processor types or calling applications are most exposed, nor whether public proof-of-concept material exists. The record does not list a vendor advisory beyond the upstream pull request, so the exact scope of the fix is inferred from the description. The CVSS 3.1 and 4.0 scores come from different providers and should not be merged.

Frequently asked questions

Which Eclipse OMR versions are affected by CVE-2026-1188?

The record lists the affected range as from 0.2 up to, but not including, 0.8.0. The fixed version is 0.8.0.

Is CVE-2026-1188 known to be exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.