CVE-2026-13502

Name of the Vulnerable Software and Affected Versions ANTLR4 versions prior to 4.13.3

Description A time-of-check time-of-use (TOCTOU) flaw exists in the Maven Plugin component. This issue occurs within the ObjectInputStream.readObject() function located in the antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java file. TOCTOU is a race condition where a system checks the state of a resource before using it, but the state changes between the check and the use. Exploitation requires local execution and is characterized by high complexity and difficult exploitability.

Recommendations Update to a version newer than 4.13.2. As a temporary mitigation, restrict local access to the Maven Plugin component to minimize the risk of exploitation.