A buffer overflow can occur when the API that lists processor feature names omits the separator length in its bounds checking. The exposed input buffer, if sized incorrectly, permits a write beyond the buffer limits, which can corrupt memory and trigger arbitrary code execution. The weakness is represented by CWE-120 and CWE-131, both describing buffer overflows and incorrect size handling.

Eclipse Foundation’s Eclipse OMR port library, starting from release 0.2.0, is affected. All builds prior to 0.8.0 lack the fix and are therefore vulnerable.

The CVSS score of 6.9 indicates moderate severity. EPSS is below 1%, suggesting exploitation is unlikely in the near term, and the vulnerability is not listed in the KEV catalog. The vulnerability would be exploited by an attacker who can control the buffer size input to the API; the attack requires code to invoke the vulnerable function, so the risk is mainly local to instances running the affected library. The likely vector is local or compromised application code, with potential to lead to remote code execution if the application is exposed.