A malformed .class file containing deeply nested annotations can trigger a segmentation fault in Eclipse OpenJ9 JVMs up to version 0.60. The resulting crash terminates the Java process, potentially taking down applications that rely on the JVM. This flaw is a classic use of uninitialized data exploitation, reflected in CWE-674, and also demonstrates a buffer overflow condition, reflected in CWE-787, resulting in an integrity loss of the affected process and a denial of service for the application it hosts. No evidence indicates that the fault could be escalated to other privileges or that state is persisted beyond the immediate crash.

Eclipse OpenJ9 implementations from the beginning up to and including version 0.60 are affected. Any system that loads user‑supplied or untrusted .class files at runtime on these versions is at risk.

The CVSS score for this flaw is 5.7, indicating moderate risk. The EPSS score is 0.00235, reflecting a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the ability to deliver a specially crafted .class file to the JVM, either locally or remotely, that can be parsed during class loading. The overall risk remains low to moderate, with the primary concern being a denial of service to the affected Java application.