CVE-2026-9158

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - emo@eclipse.org

Published

2026-06-18

Last modified

2026-10-26

Weaknesses

CWE-416

Affected products

• 4diac Forte (Eclipse)
• Eclipse 4diac (Eclipse Foundation)

References

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/109