CVE-2026-16243: Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
Published Jul 21, 2026
·Updated
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.
Affected Software
5 affected components
Eclipse OMR OMR<=0.11
IBM WebSphere Application Server<=8.5
IBM WebSphere Application Server<=9.0
IBM WebSphere Application Server - Liberty<=Continuous delivery
Eclipse OMR>=0.1.0<=0.10.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse OMR arraycmp SIMD implementation (Z and P)to a version that resolves this vulnerability.Fixed in 0.11
Event History
Jul 21, 2026
CVE Published
via MITRE·05:46 PM
Data Sourced
via MITRE·05:46 PM
DescriptionWeakness
Data Sourced
via NVD·06:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·07:01 PM
DescriptionSeverityAffected Software
Aug 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-16243?
CVE-2026-16243 has a medium severity rating of 5.7.
2
How do I fix CVE-2026-16243?
To fix CVE-2026-16243, update to the latest version of Eclipse OMR that addresses this vulnerability.
3
What is the risk associated with CVE-2026-16243?
CVE-2026-16243 has a risk score of 31, indicating a medium level of risk.
4
What issue does CVE-2026-16243 introduce in Eclipse OMR?
CVE-2026-16243 introduces an issue where the arraycmp SIMD implementation does not check if the number of bytes to compare is zero.
5
Which versions of Eclipse OMR are affected by CVE-2026-16243?
Versions of Eclipse OMR up to 0.11 are affected by CVE-2026-16243.