Critical severity · published Jan 29, 2026
CVE-2026-1188
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator…
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
Eclipse OMR · Eclipse Foundation
0.2.0 before 0.8.0 · source: vendor
OM
Omr · Eclipse
0.2 before 0.8.0 · source: NVD
Affected product
EO
Eclipse OMR
Eclipse Foundation
More from Eclipse OMR
7.8
CVE-2025-1471
Eclipse OMR: Buffer overflow vulnerability
7.5
CVE-2026-16243
Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
5.5
CVE-2025-1470
Eclipse OMR: Null pointer dereference vulnerability