Paper/Archive/CVE-2026-78299

CVE-2026-78299

Eclipse Foundation Eclipse Embedded CDT (C/C++ Development Tools) — In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extrac…

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 45.3.453 × 209.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

Affected

ProductAffectedFixed inSource

Eclipse Embedded CDT (C/C++ Development Tools)6.0.0 – < 6.8.06.8.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgitlab.eclipse.org/security/vulnerability-reports/-/work_items/747 refgithub.com/eclipse-embed-cdt/eclipse-plugins/security/advisories/GHSA-qch4-8rmp-mjx3