Eclipse OpenJ9 performs an incorrect method resolution when a previously concrete superclass method has been compiled as abstract. In those cases, the runtime delegates execution to an interface default method instead of the abstract super method. This flaw can disrupt application logic and allows an attacker to invoke unintended method code if they can supply a class file with such a pattern, potentially leading to confidentiality or integrity issues in the program flow. The weakness is an unchecked return value error (CWE‑758).

The issue affects the Eclipse Foundation’s OpenJ9 Java Virtual Machine, specifically versions up to 0.60 inclusive. All users running those OpenJ9 builds that load class files whose superclass methods become abstract during recompilation are impacted.

The CVSS score of 6.9 designates medium severity, and the EPSS score is reported as less than 1 %, indicating a very low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, involves the execution of a specially crafted class file in an environment that uses the affected OpenJ9 runtime; an attacker who can deploy such a file could trigger the incorrect method selection and run the interface default method. The impact is limited to the Java application running on the vulnerable JVM; there is no evidence of remote code execution beyond the incorrect method dispatch.