CVE-2026-1188 Memory corruption in Eclipse OMR

What is CVE-2026-1188?

CVE-2026-1188 is a medium-severity memory corruption vulnerability in Eclipse OMR, published on 29 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.

Weakness: CWE-120, CWE-131

Which versions are affected by CVE-2026-1188?

It affects 1 product.

Products include Eclipse Omr.

How do I fix CVE-2026-1188?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-1188 being exploited?

There is no known exploitation of CVE-2026-1188 in the wild and no public exploit code.

Other vulnerabilities in Eclipse OMR

• CVE-2019-11773 Privilege escalation in Eclipse OMR High 7.8
• CVE-2019-11774 Race condition in Eclipse OMR High 7.4
• CVE-2025-1471 Eclipse OMR: Buffer overflow vulnerability High 7.1
• CVE-2025-14549 OMR on Z processors Exposing a possible buffer over-read problem Medium 6.9
• CVE-2026-16243 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero Medium 5.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x24c-w26v-w8jg, openSUSE-SU-2026:10788-1, openSUSE-SU-2026:10789-1, openSUSE-SU-2026:10790-1, openSUSE-SU-2026:10791-1, openSUSE-SU-2026:10792-1.