CVE-2026-16439: eclipse foundation openj9 Buffer Underflow
CVSS: 9.1v3.1CriticalAnalyzed
AliasesCGA-289g-xr78-6qfgCGA-2r92-p5f9-34vxCGA-2rvw-g9rq-p563CGA-2w85-v728-55qwCGA-343j-hx5v-2g6qCGA-3446-rg8w-m3m3CGA-36j8-r6c4-2x3qCGA-3pf3-wh8c-v568CGA-3prv-jfp2-2v3rCGA-42wg-cxh7-vfg9CGA-46cg-2v8c-6p88CGA-4jmh-9mgj-4448CGA-4qmj-f85v-5977CGA-53pp-4cvf-2vc8CGA-564x-848w-3qp7CGA-58qg-mcfg-942wCGA-5chm-vjmc-xq54CGA-5mvf-w99p-qc6fCGA-5pjx-p8h3-9j77CGA-5qgp-pf9h-qh4qCGA-5v67-998r-g583CGA-6cq9-hfp2-w48rCGA-6m37-4jxj-x67hCGA-6qrp-qwwp-63cfCGA-7m47-wqg2-jj9hCGA-7mpm-9qv2-35hpCGA-8mm4-cpgq-p437CGA-8wm7-q5gj-ppjqCGA-8xc6-68fg-g6p6CGA-99f4-m997-f3r5CGA-9gmq-x2f2-f7gcCGA-9gpr-jv5w-772wCGA-9mf5-93qw-3gx7CGA-9v46-mvmg-8j6qCGA-c46m-3cm8-ffhcCGA-f29f-f34c-c4cmCGA-fhqv-jh64-wgh5CGA-fprx-x94q-wrr3CGA-frjc-g73p-82w2CGA-frvj-9629-hxj3CGA-gxvx-jmm7-45mrCGA-hc7p-428x-9g99CGA-hfpv-qp94-3w38CGA-hqfw-84x8-cq7jCGA-j452-v3mq-pg7vCGA-jqw5-c59p-2p2xCGA-jwmh-x8mc-5hcxCGA-jwvp-5pv4-94wfCGA-m2mr-q3r2-2c9vCGA-m3mh-r4g2-3423CGA-m5cc-vpq4-ppf8CGA-mff2-prqv-g4vvCGA-p2r5-6gv7-hxpxCGA-p36f-v977-h3rmCGA-p89m-fr4w-vgj9CGA-pc74-q4mj-m2mjCGA-pcr2-rr84-xfp7CGA-pfmj-jgvv-8rhwCGA-pfv5-267c-hg22CGA-q496-579p-5m6mCGA-qjmx-9455-hvjjCGA-qv6w-r82f-jfmrCGA-rc3q-ggv5-4m9jCGA-rj49-qjw8-9vgjCGA-rqfq-4rj4-mh79CGA-rwfj-4mq3-5hvmCGA-v4pc-v25p-v9vqCGA-v8fj-qqv9-pf4hCGA-v8qf-8rf5-4j78CGA-vgxj-5rr3-m945CGA-w22m-4xc8-2mjvCGA-wjq7-2cwx-8jp6CGA-wpwp-63wc-x6w4CGA-wqmg-jh98-gwq8CGA-x78p-w666-gvmxCGA-xq9r-c93v-v444CGA-xrh6-58cc-f9mgCGA-xxrr-f5m7-mxvr
Published 21-07-2026Last modified 22-07-2026
Vulnerability summary
CVE-2026-16439 is a critical (CVSS 9.1) Buffer Underflow vulnerability in eclipse foundation openj9. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.8% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
0.43%
0%100%
Low · +0.19 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 21-07-2026PublishedVulnerability first disclosed.
- 22-07-2026Last modifiedVulnerability information updated.
Description
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 5.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:L/SA:LSourcesAll 3 agree
- OSV · ChainguardEcosystem advisory · calculated5.8MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L
- NVDNIST5.8MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HSourcesSingle source
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.19 pp
From 0.24% on 18-09-2026
18-09-202618-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard39 products
- openjdk-11-openj9< 0.60.0-r0
- openjdk-11-openj9-dbg< 0.60.0-r0
- openjdk-11-openj9-default-jdk< 0.60.0-r0
- openjdk-11-openj9-default-jvm< 0.60.0-r0
- openjdk-11-openj9-doc< 0.60.0-r0
Eclipse1 product
- openj9≥ 0.8.0, < 0.60.0
Eclipse foundation1 product
- openj9≥ 0.8.0, < 0.60.0
3 vendors · 41 products
