CVE-2026-1188: eclipse foundation eclipse omr Incorrect Calculation of Buffer Size

Vulnerability summary

CVE-2026-1188 is a critical (CVSS 9.8) Incorrect Calculation of Buffer Size vulnerability in eclipse foundation eclipse omr. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities.

Timeline

1. 29-01-2026
   PublishedVulnerability first disclosed.
2. 29-01-2026
   Last modifiedVulnerability information updated.

Description

In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.

• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.