Local File Disclosure in Eclipse OpenJ9 Diagnostic Tools
CVE-2026-97400
6.8MEDIUM
What is CVE-2026-97400?
In versions of Eclipse OpenJ9 up to 0.63, a vulnerability exists where utilizing the jdmpview tool or related DTFJ code can lead to the disclosure of local files. When an analyst opens a supplied diagnostic dump bundle, the tool may read an arbitrary local file specified within the bundle and transmit its contents to a remote host, posing serious risks to data confidentiality and system integrity.
Affected Version(s)
Eclipse OpenJ9 0.8.0 < 0.63
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Duc Anh Nguyen (VinSOC) - mra9797@gmail.com