Arbitrary File Write Vulnerability in Eclipse Embedded CDT by Eclipse
CVE-2026-78299

9.1CRITICAL

Key Information:

Vendor: Eclipse Foundation
Status: Eclipse Embedded Cdt (c/c++ Development Tools)
Vendor: CVE Published:; 14 September 2026

🔔 Create Eclipse Foundation Vulnerability Alert

What is CVE-2026-78299?

In certain versions of Eclipse Embedded CDT, a vulnerability exists that allows the extraction of compromised CMSIS-Pack archives to write files outside the designated areas of the pack. This can lead to unauthorized file modifications on the disk, posing significant risks to system integrity and security.

Affected Version(s)

Eclipse Embedded CDT (C/C++ Development Tools) 6.0.0 < 6.8.0

References

https://gitlab.eclipse.org/security/vulnerability-reports...

https://github.com/eclipse-embed-cdt/eclipse-plugins/secu...

CVSS V3.1

Score:

9.1

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 14, 2026
Vulnerability Reserved
Aug 24, 2026

Credit

Eclipse Foundation Security Team

CVE-2026-78299 Data

JSON