CVE-2026-13502: A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/Gramm
A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is restricted to local execution. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13502
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-135020.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-13502 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for antlr ANTLR4
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-13503: A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the funct…nvd · 2026-06-28
- mediumCVE-2026-13501: A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vuln…nvd · 2026-06-28
- highCVE-2026-13500: A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function o…nvd · 2026-06-28
More from NVD Recent CVEs
- mediumCVE-2026-15485: A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub…2026-07-12
- highCVE-2026-15484: A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the funct…2026-07-12
- highCVE-2026-15483: A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the fun…2026-07-12
- highCVE-2026-15482: A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown …2026-07-12
- highCVE-2026-15481: A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability a…2026-07-12