This vulnerability arises from improper boundary checks in the JITServer component of Eclipse OpenJ9, allowing an attacker to send malformed protocol messages or replies. The out‑of‑bounds heap read triggers a segmentation fault that crashes the JITServer daemon or a client JVM. The result is a denial of service that can affect the availability of applications running on the JVM. The weakness corresponds to out‑of‑bounds read (CWE‑125) and unchecked input data (CWE‑20).

Systems running Eclipse OpenJ9 up to and including version 0.63.0 are affected. The flaw is confined to the JITServer component responsible for just‑in‑time compilation across JVM processes. Users of OpenJ9 applications that rely on the JITServer for remote compilation or inter‑process communication are vulnerable unless they are on a newer version.

The CVSS score of 8.7 indicates a high severity and the vulnerability is exploitable by any unauthenticated remote host that can reach the JITServer interface. Because the exploit requires only the transmission of crafted payloads over the network, it can be launched from anywhere the service is reachable, with no special privileges. The lack of an EPSS score and absence from the KEV catalog suggest no widespread known exploitation at this time, but the potential for service disruption remains high.