CVE-2025-4447 Buffer Overflow in Eclipse OpenJ9

What is CVE-2025-4447?

CVE-2025-4447 is a high-severity memory corruption vulnerability in Eclipse Foundation OpenJ9, published on 9 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.

Weakness: CWE-121

Which versions are affected by CVE-2025-4447?

It affects 1 product.

Products include Eclipse Openj9.

How do I fix CVE-2025-4447?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-4447 being exploited?

There is no known exploitation of CVE-2025-4447 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Foundation OpenJ9

• CVE-2021-41035 Security feature bypass in Eclipse OMR Critical 9.8
• CVE-2020-27221 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2019-11772 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12547 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12549 Null dereference in Eclipse OpenJ9 Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wmvg-c6fc-33c8, openSUSE-SU-2025:15231-1.