CVE-2026-64815 is a high severity (CVSS 8.1) flaw in JetBrains IntelliJ IDEA before 2026.2. Arbitrary code injection was possible through UI Designer form files. Update to 2026.2 or later, confirm the fixed build on the JetBrains page, and be careful with projects from sources you do not trust.
What's affected
- Product: JetBrains IntelliJ IDEA.
- Affected: versions before 2026.2.
- Fixed: 2026.2, per the record. Confirm the exact build on the JetBrains page.
- Weakness: CWE-94, code injection. CVSS 8.1 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. - The component is the UI Designer, the Swing form editor and its
.formfiles.
How to check if you're exposed
Read the version from the IDE About dialog, or on macOS:
defaults read "/Applications/IntelliJ IDEA.app/Contents/Info" CFBundleShortVersionString
Then ask whether your teams use the UI Designer at all. Searching a repository for form files tells you where it might matter:
find . -name "*.form" -not -path "*/node_modules/*" | head
The free in-browser scan at gold.safeguard.sh/scan covers dependencies in your projects. It does not inspect installed desktop tools, so use the vendor's own version display for those.
What to do now
- List the machines and images that run IntelliJ IDEA and note each version.
- Update anything before 2026.2 to 2026.2 or later.
- Confirm the fixed build on the JetBrains fixed security issues page.
- Treat repositories from unknown sources as untrusted. Open them in a throwaway environment rather than on a machine with deploy credentials.
Why it matters
Form files describe a user interface, but an IDE reads them and acts on what they contain. When that handling lets text turn into code, the result is CWE-94. The record says arbitrary code injection was possible.
The score is held below 9 because the vector marks attack complexity as high. Even so, an IDE runs with the developer's full access. The KEV flag is false, and the record does not report exploitation.
Quick check
Do I need the UI Designer for this to apply?
The record ties the flaw to UI Designer form files. If you never open those, your practical exposure is smaller, but updating is still the right fix.
What is the fixed version?
IntelliJ IDEA 2026.2, per the record.
Sources
- JetBrains fixed security issues page (listed in the record, but its entries did not load when I reviewed it)
Last reviewed: 19 October 2026.
