The vulnerability resides in the OutputFile.java file within the ANTLR4 Grammar Action Block Handler and is present in all versions up to and including 4.13.2. An attacker can supply crafted input that causes the parser to execute arbitrary code, leading to a remote code execution scenario. The weakness maps to CWE‑74, involving untrusted paths or resources, and CWE‑94, involving improper handling of input to a compiler or interpreter.

All users of ANTLR4 whose deployments include the Grammar Action Block Handler function are affected. Specifically, ANTLR4 versions 4.13.2 and earlier are vulnerable; newer releases beyond 4.13.2 have not been identified as affected in this advisory.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, but the exploit is publicly released and can be invoked remotely. Because the vulnerability is publicly known and no vendor response has been received, the risk remains significant. The attack likely requires only a malicious grammar definition submitted to the parser, making exploitation straightforward for an attacker who can influence grammar construction.