CVE-2026-111075

Awaiting Analysis Awaiting Analysis - Queue

Heap Out-of-Bounds Read in Eclipse OpenJ9 JITServer

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Eclipse Foundation

Description

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-111075

EUVD

EUVD-2026-107138

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	Eclipse OpenJ9	0.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-111075 is a vulnerability in Eclipse OpenJ9 versions before 0.63.0 affecting the JITServer component. It involves improper validation of message descriptors during deserialization. Attackers can craft malicious payloads with manipulated _size, _paddingSize, and _dataOffset fields, causing an unsigned integer underflow. This leads to out-of-bounds heap reads and immediate process crashes (SIGSEGV), resulting in denial of service.

Detection Guidance

To detect this vulnerability, monitor for crashes in the JITServer component of Eclipse OpenJ9, specifically SIGSEGV errors during message deserialization. Check logs for out-of-bounds heap reads or crashes in ServerStream::readCompileRequest(). Use network traffic analysis to identify malformed DataDescriptor messages with manipulated _size, _paddingSize, or _dataOffset fields.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the JITServer process by sending specially crafted network payloads. The crash causes a denial of service, halting the server and disrupting services relying on JITServer for Just-In-Time compilation. Systems using vulnerable OpenJ9 versions are at risk of unexpected outages.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing the JITServer component, which could disrupt services handling sensitive data. While it does not directly expose or alter data, prolonged downtime may impact availability of systems processing personal or health information, potentially violating GDPR's availability principle or HIPAA's access requirements. However, no evidence suggests data confidentiality or integrity is compromised.

Mitigation Strategies

Upgrade Eclipse OpenJ9 to version 0.63.0 or later to address the vulnerability. If upgrading is not immediately possible, restrict network access to JITServer, implement strict input validation for incoming messages, and monitor for suspicious payloads. Apply the validation fixes from pull request #25009 as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-111075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...