CVE-2026-9158 - In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer

Back Back to CVE browser

MEDIUM

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer

Published Jun 18, 2026

5.2

MEDIUM

CVSS 4.0

EPSS 0.60%

Description

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).

Affected products

Vendor Eclipse Foundation Product Eclipse 4diac Default
unaffected
- Version
  3.0.0
  Status
  affected
  Constraints
  <=3.1.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Eclipse Foundation

Eclipse 4diac

unaffected

Version	Status	Constraints
3.0.0	affected	<=3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37896
Advisory
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/109
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37896		Advisory
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/109		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner eclipse

Published Jun 18, 2026

Updated Jun 18, 2026

Reserved May 21, 2026

Link CVE-2026-9158

CISA Vulnrichment

Updated Jun 18, 2026

NVD

Status Analyzed

Modified Jul 2, 2026

Link CVE-2026-9158

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-9158

ENISA EUVD

Assigner eclipse

Published Jun 18, 2026

Updated Jun 18, 2026

Exploited since n/a

Link EUVD-2026-37896

EUVD-2026-37896