CVE-2021-41041
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.1%
exploitation probability
1.1%top 37% of all CVEs
observed exploitation
nono source reports it
In short
Eclipse Openj9 fails to properly report errors when verifying Java bytecode during MethodHandle calls, potentially allowing unsafe code to run without being caught.
Technical detail
CVE-2021-41041 involves improper exception handling (CWE-252) during bytecode verification in Openj9 when triggered via MethodHandle invocation. An attacker can craft bytecode that bypasses verification checks, leading to execution of unverified methods with potential memory corruption or privilege escalation impacts.
Summary generated and translated by AI from the official description.
In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.
Affected products
The Eclipse Foundation · Eclipse OpenJ9