Eclipse OpenJ9 versions up to 0.60 contain a buffer underflow flaw that is triggered when the -Xtrace option is used to trace method arguments. Classified as CWE-124, this vulnerability can lead to a buffer underflow during execution. The CVE description does not detail additional effects such as arbitrary code execution, but a buffer underflow generally risks memory corruption and application instability.

The affected product is Eclipse Foundation's OpenJ9, with all releases up to and including 0.60 being vulnerable. Users running these versions with the -Xtrace flag active are at risk.

The CVSS score of 5.8 rates this issue as moderate; the EPSS score indicates a very low exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. The exploit requires the ability to start or modify the JVM with -Xtrace, so it is likely a local or privileged remote scenario. Because the flaw arises during JVM startup, an attacker would need to control JVM launch parameters or have local privileges to affect the process.