CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure

Medium 6.9 Published 21 Jul 2026 Updated 22 Jul 2026

Attackers can trigger incorrect method resolution in Eclipse OpenJ9, potentially leading to arbitrary code execution via malicious class files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-16441?

CVE-2026-16441 is a medium-severity vulnerability in Eclipse Foundation OpenJ9, published on 21 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

Weakness: CWE-758

Which versions are affected by CVE-2026-16441?

It affects 1 product.

Products include Eclipse Openj9.

How do I fix CVE-2026-16441?

Upgrade to a fixed version.

Is CVE-2026-16441 being exploited?

There is no known exploitation of CVE-2026-16441 in the wild and no public exploit code.

Sources

Also known as GHSA-cp45-6q6c-3772, GHSA-hcfc-9hjx-2q7f.