CVE-2026-9158

Use‑After‑Free via DELETE Connection in Eclipse 4diac FORTE Management Interface

Published Jun 18, 2026 CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Description

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).

Analysis

Technical impact

Eclipse 4diac FORTE versions 3.0.0 through 3.1.0 contain a use‑after‑free condition triggered by a crafted DELETE connection command sent to the management interface. The bug causes a dangling pointer to remain after a connection has been deleted, and subsequent commands can dereference the freed memory. An attacker who can supply such a command could read or corrupt data in memory, potentially crashing the application or manipulating its internal state.

Affected Systems

Eclipse Foundation's Eclipse 4diac FORTE product is affected. The vulnerable releases are 3.0.0 up to and including 3.1.0. No other versions have been identified as affected.

Risk and Exploitability

The CVSS score of 5.2 indicates a medium severity vulnerability. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. Based on the description, it is inferred that an attacker must be able to send crafted DELETE connection requests to the management interface, which could be accessed locally or over a network. Exploitation could result in application crashes or memory corruption, but no proof of arbitrary code execution is documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Eclipse Foundation

Eclipse 4diac

unaffected

Version	Status	Constraints
`3.0.0`	affected	≤ 3.1.0

Configuration 1 [-]

cpe:2.3:a:eclipse:4diac_forte:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Eclipse

4diac

Version	Status	Scheme	Platform
`[3.0.0,3.1.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Eclipse 4diac FORTE to a version after 3.1.0 that eliminates the use‑after‑free flaw.
Restrict access to the management interface by limiting network exposure to trusted hosts or implementing role‑based authentication.
Validate all DELETE connection commands on the server side to reject malformed requests and prevent dereferencing of freed memory.

Generated by OpenCVE AI on June 18, 2026 at 19:42 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.601% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/109

History

Jun 24, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Eclipse Eclipse 4diac
Vendors & Products		Eclipse Eclipse 4diac

Jun 18, 2026 8:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Use‑After‑Free via DELETE Connection in Eclipse 4diac FORTE Management Interface

Jun 18, 2026 4:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).
Weaknesses		CWE-416
References		https://gitlab.eclipse.org/security/cve-assignment/-/work_items/109
Metrics		cvssV4_0 `{'score': 5.2, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:P/RE:L/U:Green'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`