CVE-2026-1188: 
Chainguard vulnerability analysis and mitigation

CVE-2026-1188 is a buffer overflow vulnerability in the Eclipse OMR port library component affecting versions 0.2.0 through 0.7.x (fixed in 0.8.0). The flaw exists in an API function (omrsysinfo_get_processor_feature_string) that returns textual names of all supported processor features but fails to account for the separator character inserted between feature names when calculating safe write boundaries for the output buffer. This incorrect buffer size calculation (CWE-131) can lead to a classic buffer overflow (CWE-120) if the caller supplies an undersized output buffer. The vulnerability was published on January 29, 2026, with a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (Red Hat CVE, GitHub PR).

The root cause is classified as CWE-131 (Incorrect Calculation of Buffer Size) and CWE-120 (Buffer Copy without Checking Size of Input). The omrsysinfo_get_processor_feature_string function in the Eclipse OMR port library iterates over supported processor features and writes their names into a caller-supplied output buffer. When checking whether a write is safe, the function did not account for the separator character placed between feature name strings, meaning the boundary check could be off by at least one byte per separator, potentially allowing writes beyond the end of the buffer. The fix, merged on January 9, 2026 via GitHub pull request #8082 (commit 9713b5d), ensures the separator length is included in the buffer space calculation before each write (GitHub PR). Because Eclipse OMR is embedded in IBM Semeru Runtime (OpenJ9-based JVM) and numerous IBM products, the vulnerable code path is reachable wherever the JVM queries processor feature strings.

Successful exploitation could result in memory corruption leading to arbitrary code execution, information disclosure, or denial of service on affected systems, impacting confidentiality, integrity, and availability. The vulnerability is present in Eclipse OMR versions 0.2.0–0.7.x and transitively affects a broad range of IBM products that bundle IBM Semeru Runtime, including IBM MQ, IBM Data Product Hub, IBM InfoSphere Data Architect, IBM Data Studio, IBM Data Virtualization, IBM Cognos Controller, IBM Sterling Transformation Extender, IBM Security Verify Access, IBM Enterprise Content Management System Monitor, and others (IBM MQ Bulletin, IBM Data Product Hub). The wide deployment footprint of IBM enterprise software increases the potential blast radius, and exploitation could enable lateral movement within environments relying on these products.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-1188 as of the available data. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. While the CVSS v3.1 score is 9.8 (Critical) due to network-reachable attack vector and no authentication requirement, the CVSS v4.0 score of 6.9 (Medium) reflects more nuanced impact modeling. No threat actor attribution has been identified.

The primary remediation is to upgrade Eclipse OMR to version 0.8.0 or later, which includes the fix merged on January 9, 2026 (GitHub PR). For IBM products, apply the vendor-specific security bulletins: IBM MQ users should apply the Semeru Runtime update referenced in the IBM MQ bulletin; IBM Data Product Hub, InfoSphere Data Architect, Data Studio, Data Virtualization, Cognos Controller, Sterling Transformation Extender, Security Verify Access, and Enterprise Content Management System Monitor users should apply the respective IBM security bulletin patches (IBM Data Product Hub, IBM Sterling Transformation Extender). SUSE Linux Enterprise users should apply the updates referenced in SUSE security announcements (SUSE-SU-2026:2036-1 and SUSE-SU-2026:2110-1). No configuration-based workaround has been published; patching is the only recommended mitigation.

IBM issued multiple security bulletins across its product portfolio acknowledging the vulnerability and providing patched versions, reflecting the broad impact of the Eclipse OMR dependency in IBM Semeru Runtime (IBM MQ Bulletin). Security news outlets including GBHackers, CyberSecurityNews, and CyberPress covered the IBM Security Verify Access vulnerabilities (which include CVE-2026-1188) under headlines noting remote attacker access to sensitive data (GBHackers, CyberSecurityNews). Heise.de reported on related IBM product vulnerabilities in the context of malware and DoS risks (Heise). Community reaction has been moderate, with standard vulnerability aggregator coverage but no notable researcher commentary or exploit demonstrations.