NULL Pointer Dereference Vulnerability in Eclipse OMR Affecting z/OS Functions

CVE-2025-1470

Summary

In Eclipse OMR versions prior to 0.5.0, there is a vulnerability within the internal port library and utilities that interface with z/OS atoe functions. These components fail to validate the return values for NULL pointers and memory allocation errors, which may unexpectedly lead to application crashes due to NULL pointer dereferences. The issue has been resolved in version 0.5.0, wherein the internal consumers of atoe functions have been updated to properly handle NULL return values and memory allocation failures.

References