CVE-2026-1188: Buffer Overflow in Eclipse OMR Port Library

CVE-2026-1188 is a critical buffer overflow (CVSS 9.8) in the Eclipse OMR port library since release 0.2.0. A function that lists processor feature names did not allow for the separator, so a wrongly sized buffer can overflow. It is fixed in Eclipse OMR 0.8.0. First find out whether you embed OMR.

What's affected

From the CVE record and the fix pull request:

• Product: Eclipse OMR, port library component, from release 0.2.0.
• Fixed version: Eclipse OMR 0.8.0, which was published on 19 January 2026.
• Function: the API that returns processor feature names, omrsysinfo_get_processor_feature_string according to the title of pull request 8082, merged on 9 January 2026.
• Weakness classes: CWE-120 (buffer copy without checking input size) and CWE-131 (incorrect calculation of buffer size).
• Severity: CVSS 9.8 in the record. The vector is network reachable with no privileges and no user interaction.
• Condition: the record says the overflow can occur if the buffer supplied by the caller is incorrectly sized, so exposure depends on how a program calls the function.

How to check if you're exposed

OMR is a toolkit that other projects embed, so you usually inherit it instead of installing it on its own.

1. Find out whether any software you build or run bundles Eclipse OMR. Look in dependency manifests, vendored directories and git submodules for omr.
2. Read the version, or the commit, of the bundled copy. Anything from 0.2.0 up to but not including 0.8.0 is in range.
3. Search your own code and any patches for calls to the processor feature string function and read how the buffer size is chosen.
4. For a runtime or product built on OMR, check the vendor's own security notes for how they ship the fix.

A dependency scan will show OMR when it appears in a manifest. Paste a lockfile or manifest into gold.safeguard.sh/scan to check.

What to do now

1. Find every place OMR is bundled or vendored, starting with the build systems you control.
2. Move to Eclipse OMR 0.8.0 or later. The release notes are on the OMR releases page, and later releases exist.
3. If you cannot upgrade, make sure every call to the function passes a buffer sized to include the separators, or backport the change in pull request 8082.
4. Rebuild and redeploy the software that embeds OMR, and confirm in the build log that the new copy is the one linked.
5. Ask upstream vendors that embed OMR which of their releases carry the fix.

Why it matters

This is an off by one style size calculation. The function writes feature names into a caller supplied buffer, and between names it inserts a separator. The check that decided whether a write was safe left the separator out of the arithmetic, so when the buffer size was wrong the write could run past the end. The classes are buffer copy without a size check and incorrect calculation of buffer size.

The vector gives High impact on confidentiality, integrity and availability and says no privileges are needed, which is why the base score is 9.8. The score describes what is possible in a worst case. The condition in the record, an incorrectly sized buffer supplied by the caller, matters a great deal. A program that always supplies a large enough buffer is not exposed in the same way, and a program that passes sizes from outside input is.

That is where reachability analysis helps: knowing that OMR is present is step one, and knowing whether your code calls the affected function with an untrusted size is step two. Patching is the answer either way, and the second question tells you how fast you need to move. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry and CVE record: CVE-2026-1188.
• Pull request 8082 in eclipse-omr/omr, "Ensure room for separator in omrsysinfo_get_processor_feature_string", merged 9 January 2026.
• Eclipse OMR releases, for the 0.8.0 release date.

Last reviewed: 19 October 2026.