CVE-2025-14549

HighCVSS 8.1

Published: 15/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

In the Eclipse OMR compiler component since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers on Z processors incorrectly handles NUL (0x00) characters during Latin-compatible charset to IBM-1047/037 translation, potentially causing output truncation and buffer over-read. Fixed in version 0.8.0.

Risk Assessment

The risk includes potential data corruption or information leakage due to improper character handling, which could affect data integrity in applications using the compiler.

Recommendation

Update Eclipse OMR to version 0.8.0 or later and test applications using character translation on Z processors.

Other vulnerabilities in Eclipse OMR

CVE-2026-16243High
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

Original NVD description (English source)

In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers of OMR on Z processors incorrectly handles NUL (0x00) characters during the Latin-compatible charset (UTF-8, ISO8859-1, ASCII, etc) to IBM-1047/037 translation sequence. This can cause the output byte array to be truncated, discarding the first NUL byte and all subsequent characters, and thereby exposing a possible buffer over-read problem. This issue is fixed in Eclipse OMR version 0.8.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS