Vulnerability · Published Feb 21, 2025 · Assigned by eclipse

CVE-2025-1471Eclipse OMR: Buffer overflow vulnerability

High 7.1

In plain English

A high-severity out-of-bounds write in Eclipse OMR from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 92.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized correctly and checked appropriately to prevent buffer overflows.

Affected products (as reported)

Vendor	Product	Versions
Eclipse Foundation	Eclipse OMR	0.2.0 – before 0.4.0

Weakness: CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References