CVE-2024-3933: eclipse foundation open j9 Out-of-bounds Read
Vulnerability summary
CVE-2024-3933 is a high (CVSS 7.3) Out-of-bounds Read vulnerability in eclipse foundation open j9. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 27-05-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.arrayCopy on the IBM Z platform with hardware and software support for guarded storage [1], could allow access to a buffer with an incorrect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. This allows read and write to addresses beyond the end of the array range.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:LDiffers
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
0.00 pp
From 0.21% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-805Buffer Access with Incorrect Length ValueThe product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Affected systems
2 vendors · 2 products