The vulnerability in Eclipse OpenJ9’s JITServer allows an unauthenticated remote attacker to send a crafted network message that causes an unsigned integer underflow during DataDescriptor deserialization. The resulting out-of-bounds heap read triggers an immediate process crash (SIGSEGV). This failure mode is accurately represented by CWE-125 (Out-of-bounds Read) and CWE-191 (Integer Underflow). The crash leads to a denial of service for the affected JVM instance.

Eclipse Foundation’s Eclipse OpenJ9 binary builds with a JITServer component, specifically those versions prior to 0.63.0, are affected. Users running these older releases on any platform are at risk if JITServer is enabled and reachable over the network.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is not available, so the statistical likelihood of exploitation cannot be precisely quantified; however, the attack does not require authentication and can be performed remotely via the JITServer protocol. The failure is deterministic once the crafted payload is delivered, providing an attacker a clear exploit path. Because the vulnerability is not listed in the CISA KEV catalog and no public exploit code is reported, the risk is primarily governed by the high CVSS and the fact that the attack vector is network-based and unauthenticated.