The vulnerability resides in Eclipse OMR’s arraycmp SIMD implementation for the Z and P architectures, present in all releases up to version 0.11. A missing validation that the number of bytes to compare is zero can cause the routine to perform an invalid memory comparison, leading to undefined behavior and the potential for a buffer under‑read (CWE‑125).

All deployments of Eclipse OMR version 0.11 or earlier are affected. Any application or system that compiles against or links with these library versions is potentially impacted.

The security severity is moderate, reflected by a CVSS score of 5.7. The EPSS score is listed as < 1 %, indicating an extremely low likelihood of exploitation, and the vulnerability is not catalogued in the CISA KEV database. Exploitation would likely require an attacker to cause the array comparison routine to be invoked with a zero‑byte count, possibly through crafted input that triggers the faulty path. No remote code execution or privilege escalation is documented in the available data.