AzeoTech DAQFactory Use After Free Vulnerability Allowing Memory Corruption and Code Execution

A use after free vulnerability has been identified in AzeoTech DAQFactory release 20.7 (Build 2555) and prior. This vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files, potentially allowing an attacker to execute code in the context of the current process.

Impact

Exploitation of this vulnerability can lead to memory corruption, allowing for arbitrary code execution in the context of the current process.

Remediation

AzeoTech has released an update to address this vulnerability in DAQFactory version 21.1. Users are also advised to store .ctl files in a folder only writable by admin-level users, operate in 'Safe Mode' when loading documents that have been out of their control, and apply a document editing password to their documents.