Eclipse OpenJ9 up to 0.49.0 OpenJDK stack-based overflow

Summaryinfo

A vulnerability was found in Eclipse OpenJ9 up to 0.49.0. It has been rated as critical. The affected element is an unknown function of the component OpenJDK. Performing a manipulation results in stack-based overflow. This vulnerability is cataloged as CVE-2025-4447. The attack must be initiated from a local position. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical has been found in Eclipse OpenJ9 up to 0.49.0. This affects an unknown function of the component OpenJDK. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.

It is possible to read the advisory at gitlab.eclipse.org. This vulnerability is uniquely identified as CVE-2025-4447 since 05/08/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 236761 (IBM Java 7.1 < 7.1.5.26 / 8.0 < 8.0.8.45), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (236761) and CERT Bund (WID-SEC-2025-1056). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• IBM Maximo Asset Management
• IBM DB2
• IBM InfoSphere Information Server
• Red Hat Enterprise Linux
• IBM Tivoli Netcool/OMNIbus
• IBM SPSS
• HCL Commerce
• IBM Business Automation Workflow
• IBM Security Guardium
• IBM MQ
• IBM Power Hardware Management Console
• IBM Rational Business Developer
• IBM InfoSphere Identity Insight
• IBM Tivoli Monitoring
• IBM Semeru Runtime
• IBM Integration Bus
• IBM DataPower Gateway
• IBM App Connect Enterprise
• IBM License Metric Tool
• IBM Security Verify Access
• IBM TXSeries
• IBM Sterling Connect:Direct
• IBM Tivoli Business Service Manager
• HCL BigFix

Productinfo

Vendor

• Eclipse

Name

• OpenJ9

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion