CVE-2025-1471

High

Published: 21 February 2025

Published

21 February 2025

Modified

05 March 2025

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0010 28.0th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1471 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Eclipse Omr. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws, directly addressing this buffer overflow by mandating upgrade to Eclipse OMR 0.5.0 or later.

SI-16 Memory Protection good match

prevent

Implements memory protections like stack guards, DEP, and ASLR to block exploitation of buffer overflows for arbitrary code execution.

SI-10 Information Input Validation partial match

prevent

Mandates validation of inputs to atoe print functions to reject oversized format strings and arguments that trigger the fixed-size buffer overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local buffer overflow in print functions directly enables arbitrary code execution from low-privileged context, matching Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning…

in version 0.5.0, the conversion buffers are sized correctly and checked appropriately to prevent buffer overflows.

Deeper analysisAI

CVE-2025-1471 is a buffer overflow vulnerability (CWE-787) affecting Eclipse OMR versions 0.2.0 through 0.4.0. It occurs in certain z/OS atoe print functions, which use a fixed-length buffer for string conversion from ASCII to EBCDIC. When the input format string and arguments exceed the buffer size, a buffer overflow results. The vulnerability was published on 2025-02-21 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. By providing oversized input to the affected print functions, the attacker can trigger the buffer overflow, potentially leading to arbitrary code execution, data corruption, or denial of service through high-impact confidentiality, integrity, and availability violations.

Advisories recommend upgrading to Eclipse OMR version 0.5.0 or later, where conversion buffers are dynamically sized and properly checked to prevent overflows. The fix is detailed in the upstream pull request at https://github.com/eclipse-omr/omr/pull/7658, with CVE assignment tracked at https://gitlab.eclipse.org/security/cve-assignement/-/issues/55.