A malicious UI Designer form file can be loaded in JetBrains IntelliJ IDEA when the IDE is run in Safe Mode, allowing arbitrary code to execute. The vulnerability permits an attacker to run code with the privileges of the user running the IDE, potentially compromising the integrity and confidentiality of the local system. CWE-829 indicates that this issue arises from improper permission handling during the deserialization of UI forms.

The bug affects all JetBrains IntelliJ IDEA editions released before 2026.3. Versions 2026.2 and earlier are vulnerable when Safe Mode is enabled during the loading of UI Designer form files.

The CVSS score of 7.8 demonstrates a high severity. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been exploited in the wild. Attackers would need local access to a user who opens IntelliJ in Safe Mode and loads a crafted form file, making the exploitation feasible for insiders or with physical access. The lack of an exploitation record means the risk is primarily theoretical, yet the high CVSS advises vigilance.