CVE-2024-3933

CVE-2024-3933 is a vulnerability in Eclipse OpenJ9 versions prior to 0.44.0 and after 0.13.0, specifically when using the -Xgc:concurrentScavenge JVM option on IBM Z platforms with guarded storage. It allows out-of-bounds read and write access during System.arrayCopy operations if source and destination memory regions overlap while a Concurrent Scavenge GC cycle is active. Rated with a CVSS score of 7.3 (High), this vulnerability has a local attack vector with low attack complexity, requiring low privileges and no user interaction. Successful exploitation could lead to high confidentiality and integrity impacts, and a low availability impact. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal.