CVE-2025-14549: OMR on Z processors Exposing a possible buffer over-read problem
In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers of OMR on Z processors incorrectly handles NUL (0x00) characters during the Latin-compatible charset (UTF-8, ISO8859-1, ASCII, etc) to IBM-1047/037 translation sequence. This can cause the output byte array to be truncated, discarding the first NUL byte and all subsequent characters, and thereby exposing a possible buffer over-read problem. This issue is fixed in Eclipse OMR version 0.8.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14549?
CVE-2025-14549 is categorized as a moderate severity vulnerability due to its impact on charset translation.
How do I fix CVE-2025-14549?
To fix CVE-2025-14549, update Eclipse OMR to a version newer than 0.8.0, which addresses this vulnerability.
What specific component is affected by CVE-2025-14549?
CVE-2025-14549 affects the Eclipse OMR compiler component under specific charset translation scenarios.
Which versions of Eclipse OMR are vulnerable to CVE-2025-14549?
Eclipse OMR versions from 0.7.0 up to, but not including, 0.8.0 are vulnerable to CVE-2025-14549.
What types of systems are impacted by CVE-2025-14549?
CVE-2025-14549 impacts systems using Eclipse OpenJ9 that leverage the Eclipse OMR compiler on Z processors.