CVE-2026-97400

EUVD-2026-105014
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
eclipseCNA
6.8 MEDIUM
LOCAL
LOW
NONE
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.29%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
eclipseopenj9
0.8.0 ≤
𝑥
< 0.63
CNA
Common Weakness Enumeration
References
https://github.com/eclipse-openj9/openj9/pull/25003
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/324
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/949