IntelliJ IDEA EUVD-2026-33391

Exploitation requires the victim to open a maliciously crafted .form file using the UI Designer feature in IntelliJ IDEA (versions before 2026.1) on a local machine - this is confirmed by CVSS AV:L (local attack vector) and UI:R (user interaction required). The attacker must first deliver the malicious file to the victim's local filesystem or induce the developer to open it from a remote location. The vulnerability is limited to the UI Designer XML form parser specifically; other IntelliJ IDEA file types are not implicated. PR:N indicates no IDE-level credentials or roles are required to craft the malicious document. Exploitation is further limited to confidentiality impact only (C:L, I:N, A:N), meaning the attacker can only read files accessible to the IDE process, not write or crash it.

The CVSS 3.1 score of 3.3 (Low) is consistent with the attack profile: AV:L limits exploitation to scenarios where the attacker can place a file on the victim's local system or convince the developer to open a remote file; UI:R means the developer must actively open the malicious form; PR:N indicates no prior authentication or IDE privileges are needed by the attacker to craft the payload; and C:L caps the confidentiality impact to partial file read. No EPSS score was provided in the source data, and the CVE is not listed in CISA's KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept was identified in the supplied data. Despite the low CVSS, XXE in a developer IDE is noteworthy because developers routinely open untrusted project files, and a successful read could expose SSH keys, tokens, or configuration files present on the developer workstation. Overall this is a low-urgency but legitimate risk for development environments.

An attacker distributes a malicious IntelliJ IDEA .form file - for example via a public GitHub repository, a shared project archive, or a phishing email - containing an XML external entity referencing a sensitive local file such as ~/.ssh/id_rsa or an environment file containing API tokens. When a developer opens the file using the UI Designer on a version prior to 2026.1, the parser resolves the external entity and may expose the file contents within the IDE or an error message. No public proof-of-concept code was identified in the available data.