CVE-2026-16441
Received Received - Intake

Incorrect Method Delegation in Eclipse OpenJ9

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Eclipse Foundation

Description
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-16441
EUVD
EUVD-2026-46359

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse openj9 to 0.60 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-758 The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eclipse OpenJ9 versions up to 0.60 occurs when a concrete superclass method is recompiled as abstract. Execution is then incorrectly delegated to an interface default method, leading to unexpected behavior.

Detection Guidance

Detection requires checking for Eclipse OpenJ9 versions prior to 0.60.0. Use commands like 'java -version' to verify the OpenJ9 version. If using a vulnerable version, inspect class files for recompiled abstract superclass methods that may delegate to interface default methods incorrectly.

Impact Analysis

It may cause IllegalAccessError to override AbstractMethodError, disrupting program execution when methods are incorrectly resolved. This can lead to crashes or incorrect behavior in Java applications running on affected OpenJ9 versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a JVM error handling issue that could lead to incorrect execution flow but does not inherently impact data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update Eclipse OpenJ9 to version 0.60 or later to address the improper handling of IllegalAccessError in the invokeinterface operation. This version includes the fix merged into the v0.60.0-release branch on July 21, 2026.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart