Delta Electronics CNCSoft Out-of-Bounds Write Vulnerability Allowing Code Execution

An out-of-bounds write vulnerability has been identified in Delta Electronics CNCSoft, specifically in version 1.01.34 and prior. This vulnerability arises from improper validation of user-supplied files, enabling an attacker to execute code within the context of the current process by opening a malicious file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the context of the current process.

Remediation

Delta Electronics has announced that CNCSoft will be removed from the Delta Download Center, as the A-series CNC products it supports have been discontinued. Users are advised to migrate to newer Delta CNC products and their corresponding software as soon as possible.