Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-1188 is a medium-severity Incorrect Calculation of Buffer Size (CWE-131) vulnerability in Eclipse Omr. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-1188 is a buffer overflow vulnerability (CWE-131, CWE-120) in the Eclipse OMR port library component, affecting versions since release 0.2.0. The flaw resides in an API function designed to return the textual names of all supported processor features. This function fails to account for the separator inserted between processor features when determining the safety of writes to the supplied output buffer. If the buffer is incorrectly sized—neglecting space for the separator—a buffer overflow can occur.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability. Remote, unauthenticated attackers can trigger the buffer overflow by supplying a mis-sized buffer to the affected API function, potentially leading to arbitrary code execution or system compromise depending on the context of the library's usage.
The issue is addressed in Eclipse OMR version 0.8.0. Additional details on the fix are available in the upstream pull request at https://github.com/eclipse-omr/omr/pull/8082.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4991
Vulnerability Data
In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this…
more
function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer security testing and code review can discover incorrect buffer-size computations before deployment.
Input validation directly enforces size checks before buffer copies.
Secure engineering principles directly require correct buffer-size arithmetic and bounds-checked allocation.
Memory-protection mechanisms limit the exploitability of an overflow that results from an incorrect size calculation.
Flaw-remediation processes that include vulnerability scanning or static analysis will surface buffer-size errors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent buffer-size miscalculations via coding standards, reviews, and testing, while fixing this single weakness only partially fulfills the broader control.
Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.
Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly require correct buffer-size calculations.
Security testing can detect buffer-size errors before release.
Secure development lifecycle mandates size-checking practices that reduce buffer-size miscalculations.
Application security requirements can specify buffer-size validation rules.
Secure architecture principles include safe memory-allocation guidelines.