EUVD-2026-37896
GHSA-j8fr-ghg4-6wpr
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:L/U:Green
Adjacent vector matches management interface exposure; PR:N per provided CVSS 4.0; integrity and availability both High due to use-after-free corruption and crash potential; confidentiality Low for incidental memory disclosure.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
1DescriptionCVE.org
In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory (use-after-free).
AnalysisAI
Use-after-free in Eclipse 4diac FORTE versions 3.0.0-3.1.0 allows adjacent, unauthenticated attackers to corrupt process memory by sending a specially crafted DELETE connection command to the management interface, leaving a dangling pointer exploitable by subsequent commands. The impact spans memory integrity corruption and availability loss (runtime crash), with a minor confidentiality exposure from stale freed-memory reads - meaningful risks in industrial automation deployments where FORTE orchestrates IEC 61499 distributed control logic. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 supplemental Safety metric is marked Partial (S:P), flagging potential downstream safety consequences in OT environments.
Technical ContextAI
Eclipse 4diac FORTE is an open-source IEC 61499 function-block runtime targeting distributed industrial automation and control (ICS/OT). Its management interface accepts structured commands - including connection lifecycle commands such as DELETE - to deploy, modify, and tear down function-block application topologies at runtime. The root cause is CWE-416 (Use After Free): when a DELETE connection command is processed, the code frees a connection object but retains a reachable pointer to the now-freed memory region. Subsequent management commands that traverse or dereference this stale pointer operate on reclaimed heap memory, enabling classic use-after-free exploitation patterns including controlled memory reads (information disclosure) and potential write primitives depending on heap layout. No CPE strings were included in the source data, but affected versions are explicitly bounded to 3.0.0 through 3.1.0 per the advisory.
RemediationAI
Consult the Eclipse 4diac security tracker at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/109 for patch availability and the confirmed fixed version - no exact fix version was present in the source intelligence, so 'Upstream fix available per vendor tracker; released patched version not independently confirmed' is the accurate patch status. Until a patched release is confirmed and deployed, restrict network-level access to the FORTE management interface using firewall ACLs or VLAN segmentation so that only authorized engineering workstations can reach the management port - this directly addresses the AV:A attack vector and eliminates the unauthenticated access condition. Where network segmentation is not immediately achievable, consider halting remote management operations and performing configuration changes only via direct local console access, accepting the operational trade-off of reduced remote management capability. Monitor FORTE management interface logs for anomalous DELETE command sequences as a detection compensating control.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today