CVE-2026-78299: Eclipse Foundation Eclipse Embedded Cdt C/c++ Development Tools

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

Affected products

• Eclipse Foundation Eclipse Embedded Cdt C/c++ Development Tools: from 6.0.0, before 6.8.0 (fixed in 6.8.0)

Published 2026-09-14. Last modified 2026-09-16.