CVE-2025-14549
Buffer Over-Read in Eclipse OMR Compiler Charset Translation
Publication date: 2025-12-15
Last updated on: 2025-12-15
Assigner: Eclipse Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eclipse | omr | 0.8.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Eclipse OMR compiler component used by Eclipse OpenJ9 on IBM Z processors. An optimization for character translation from Latin-compatible charsets (like UTF-8, ISO8859-1, ASCII) to IBM-1047/037 incorrectly handles NUL (0x00) characters. Specifically, the translation process can truncate the output byte array by discarding the first NUL byte and all characters after it, which may lead to a buffer over-read problem. The issue is due to the optimization incorrectly checking for a stop character during translation, causing premature termination when encountering a NUL byte. This was fixed by correcting the handling of the stop character check in the optimization. [1]
How can this vulnerability impact me? :
This vulnerability can cause the output byte array from character translation to be truncated unexpectedly, discarding data after the first NUL byte. This may lead to buffer over-read issues, potentially causing incorrect program behavior, data corruption, or exposing sensitive memory contents. Such impacts could affect the reliability and security of applications using Eclipse OpenJ9 on IBM Z processors. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Eclipse OMR compiler component to version 0.8.0 or later, where the issue with incorrect handling of NUL characters during charset translation on IBM Z processors has been fixed. [1]