CVE-2026-16441

Description

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

Is your site exposed to CVE-2026-16441?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-758 CWE-758

References

Other References

https://github.com/eclipse-openj9/openj9/pull/24396 https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-hcfc-9hjx-2q7f https://gitlab.eclipse.org/security/cve-assignment/-/work_items/194

Frequently Asked Questions

What is CVE-2026-16441? +

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

How do I check if I'm vulnerable to CVE-2026-16441? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-50185

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be …

CVE-2025-54811 7.1

OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads …

CVE-2024-4774 6.5

The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. …

CVE-2025-55160 6.1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there …

CVE-2026-40279 3.7

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c …

CVE-2024-58350 2.9

Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of …