This vulnerability involves an out-of-bounds read (CWE-125) in the arraycmp SIMD implementation for Z and P in Eclipse OMR versions up to 0.1. Specifically, the code fails to check whether the number of bytes to compare is zero before performing the operation, which can cause reading beyond the intended memory bounds. The CVSS 4.0 base score is 5.7, indicating medium severity. No official patch or remediation level has been provided by the vendor as of the published date.

An out-of-bounds read can lead to information disclosure or application instability. However, the vulnerability requires high attack complexity and privileges, with partial user interaction, limiting the ease of exploitation. There are no known exploits in the wild. The impact does not include confidentiality, integrity, or availability violations directly but may cause unintended behavior due to memory access errors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should monitor the Eclipse Foundation advisories for updates. Avoid using affected versions in sensitive environments until a fix is released.