Buffer overflow in Eclipse Omr

CVE-2025-1471

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized correctly and checked appropriately to prevent buffer overflows.

Vulnerability class: Buffer Overflow

EPSS: 0.002 (7.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-1471?
CVE-2025-1471 is a high-severity vulnerability in Eclipse Omr, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2025-02-21.
How severe is CVE-2025-1471?
High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2025-1471 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.