Eclipse ACTF/miChecker XXE Vulnerability Advisory (CVE-2026-14304)

XML External Entity (XXE) Vulnerability in Eclipse ACTF (including miChecker) Overview The Eclipse Accessibility Tools Framework (ACTF), versions up to 20260630 (including miChecker v3.1.0), contains an XML External Entity (XXE) vulnerability. If exploited, this vulnerability could allow a malicious third party to access local resources or internal network resources on a computer running applications that use Eclipse ACTF. Please review the list of affected Eclipse ACTF and miChecker versions and apply the recommended updates. Affected Scope Affected Application: miChecker Affected Versions: All versions up to and including 3.1.0 Potential Impact: If an attacker successfully exploits this vulnerability by loading a specially crafted subtitle file via the miChecker "Open Subtitles (SMIL format)" feature, a malicious third party may gain access to local resources or internal network resources on the computer. Remediation Mitigation / Solution: Users of miChecker 3.1.0 or earlier should uninstall the application and then install the patched version (miChecker 3.1.1 or later). For instructions on obtaining and installing the updated version, please refer to the miChecker download page (via Japanese Jump to MFC Web site). Workaround: Avoid using the "Open Subtitles (SMIL file)" feature in miChecker. Related Vulnerability Information CVSS4.0: AV:L/AC:L/AT:N/PR:N/UIA:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (Base Score: 4.6) CVSS3.0: AV:L/AC:L/PR:N/UI:N/R:U/S:C/CI:N/IA:N (Base Score: 3.3) CVE-2026-14304 Contact Information Eclipse Security Contact: Eclipse Foundation Security Eclipse ACTF Contact (Mailing List): actf-dev Mailing List (registration required) Revision History July 30, 2026: Initial release of this vulnerability information.

Goal Reached Thanks to every supporter — we hit 100%!

Eclipse ACTF/miChecker XXE Vulnerability Advisory (CVE-2026-14304)