CVE-2026-13502
antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou
- State
- Published
- Severity
- 2.0 Low
- Published
- Jun 28, 2026
- Updated
- Jun 29, 2026
- Reserved
- Jun 27, 2026
Description
A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is restricted to local execution. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.5 Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.5 Medium | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 3.5 Low | AV:L/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ANTLR4antlr |
|
References
- VDB-374498 | antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctouvdb-entrytechnical-description
- VDB-374498 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-13502 | CVE Analysis and Reportthird-party-advisory
- Submit #838685 | antlr ANTLR4 4.13.2 Unsafe Java Deserialization Maven Pluginthird-party-advisory
- https://github.com/wooyun123/wooyun/issues/7exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.