CVE-2026-97400: jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

Q: Who is exposed to this issue?

Analysts or systems that open third-party diagnostic dump bundles using jdmpview or equivalent DTFJ code are exposed. The impact occurs on the machine processing the supplied bundle, rather than requiring a network-facing OpenJ9 service.

Q: What does an attacker need to exploit it?

An attacker needs to provide a diagnostic dump bundle that the target opens with jdmpview or equivalent DTFJ code. The CVSS vector indicates local attack access, no privileges, and user interaction.

Q: What can happen if a malicious bundle is opened?

The processing machine may read an arbitrary local file named in the bundle and transmit that file's contents to an arbitrary remote host.

Q: Which versions are affected?

Eclipse OpenJ9 versions up to 0.63 are affected according to the available information.

Published Oct 20, 2026

Updated

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

Affected Software

1 affected component

Eclipse Openj9<=0.63

Event History

Oct 20, 2026

CVE Published

via MITRE·02:08 PM

Data Sourced

via MITRE·02:08 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Analysts or systems that open third-party diagnostic dump bundles using jdmpview or equivalent DTFJ code are exposed. The impact occurs on the machine processing the supplied bundle, rather than requiring a network-facing OpenJ9 service.

What does an attacker need to exploit it?

An attacker needs to provide a diagnostic dump bundle that the target opens with jdmpview or equivalent DTFJ code. The CVSS vector indicates local attack access, no privileges, and user interaction.

What can happen if a malicious bundle is opened?

The processing machine may read an arbitrary local file named in the bundle and transmit that file's contents to an arbitrary remote host.

Which versions are affected?

Eclipse OpenJ9 versions up to 0.63 are affected according to the available information.

CVE-2026-97400: jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can happen if a malicious bundle is opened?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can happen if a malicious bundle is opened?

Which versions are affected?