Eclipse miChecker XML External Entity Injection Vulnerability (CWE-611) Advisory CVE-2026-14304

Vulnerability Overview Vulnerability ID: JVNDB-2026-000111 Vulnerability Name: miChecker improper restriction of XML external entity references Description: miChecker is developed by the Eclipse Foundation and provided by the Japanese Ministry of Internal Affairs and Communications. This vulnerability involves an improper restriction of XML external entity references (CWE-611), with the CVE ID assigned as CVE-2026-14304. CVSS Score: - CVSS V3 Score: 3.3 (Low) - CVSS v4 Score: 4.6 (Medium) Impact Scope Affected Products: - miChecker versions 3.10 and earlier Impact Description: - Affected products may communicate unexpectedly by reading carefully crafted subtitle files, potentially leading to access to local resources or internal network resources. Remediation Update Software: - Based on information provided by the developer, update the software to the latest version. Apply Workarounds: - If users cannot update the software to the latest version, they can avoid the impact of the vulnerability by using the product’s "Open Subtitle (SMIL) File" function. Additional Information Reference Links: - Eclipse Foundation: GitHub - Eclipse Foundation: ACTF - miChecker Vulnerability Information - Japanese Ministry of Internal Affairs and Communications: miChecker (Japanese) Release Date First Published: September 17, 2026 Last Updated: September 17, 2026 Copyright Information Copyright: © 2007-2026 IPA. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

Eclipse miChecker XML External Entity Injection Vulnerability (CWE-611) Advisory CVE-2026-14304