CVE-2026-9158 is a use-after-free in Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, rated 9.8. A specially crafted DELETE connection command sent to the management interface leaves a dangling pointer, and later commands can touch freed memory. Check the project's releases for a fixed build.
What's affected
- Product: Eclipse 4diac FORTE, the runtime used to execute IEC 61499 control applications.
- Affected: versions 3.0.0 through 3.1.0.
- Fixed version: the CVE record does not name one. The Eclipse CVE request links a tracking issue and a pull request in the eclipse-4diac/4diac-forte repository, so check that project's release notes for the first release that includes the fix.
- Entry point: the FORTE management interface.
How to check if you're exposed
Find the FORTE version on each device or container that runs it, and check whether the management interface is reachable from networks you do not control. If you build FORTE from source, check the commit or tag you built from against the project's fix.
git -C /path/to/4diac-forte describe --tags
What to do now
- Upgrade to a FORTE release that includes the fix once the project confirms one.
- Until then, restrict the management interface to a trusted control network. Do not expose it to the internet or to office networks.
- Put a firewall rule in front of the management port that allows only your engineering workstations.
- If you ship FORTE inside a product, add this CVE to your own advisory tracking and rebuild when a fix lands.
- Watch for unexpected restarts of the runtime, which can be a sign of memory corruption.
Why it matters
The record lists CWE-416, use after free. The cause is described plainly: deleting a connection leaves a pointer that still refers to the freed object, and the next command that uses it reads or writes memory that no longer belongs to that object. Bugs of this kind often start as crashes and can sometimes be turned into code execution.
The score of 9.8 reflects network access with no privileges or user interaction. The Eclipse request itself scores the issue lower, using an adjacent network vector, so your real exposure depends on where the management interface sits. The record does not mark this CVE as exploited in the wild.
Quick check
Do I need to worry if the management interface is not on the network?
Less, but not zero. Anyone who can reach the interface from your control network can send the command, so keep that network small and monitored.
Sources
Last reviewed: 19 October 2026.
