Delta DIAScreen CVE-2025-59298

Exploitation requires the victim to manually open an attacker-supplied malicious file in Delta Electronics DIAScreen (versions 0 through < 1.6.1); the flaw is in DIAScreen's file-parsing routine and triggers an out-of-bounds write during parsing. Key LIMITING factors: attack is LOCAL (AV:L) with no network-reachable component, and REQUIRES active user interaction (UI:A) - the engineer/operator must be social-engineered into opening the file, so there is no self-propagating or drive-by path. Code executes only in the context of the current user's process (no privilege-escalation or scope change, SC:N/SI:N/SA:N), bounding impact to that user's privileges. Patching to DIAScreen 1.6.1 or later removes the condition.

This is a medium-severity (CVSS 4.0 base 6.8), client-side file-parsing flaw (CWE-787 out-of-bounds write) in Delta Electronics DIAScreen, and the signals consistently point to LOW real-world urgency rather than an active priority. The CVSS 4.0 vector confirms a LOCAL attack vector (AV:L) requiring active user interaction (UI:A) - the victim must open a malicious project/configuration file - which fundamentally limits mass exploitation; this is not a remotely reachable service bug. EPSS is 0.02% (3rd percentile), among the lowest possible, and the CVE is NOT on CISA KEV, so there is no public exploit identified at time of analysis and no evidence of exploitation. No SSVC decision data was supplied in the input, so exploitation-status/automatable/technical-impact cannot be scored from a vendor SSVC tree; however, the AV:L + UI:A profile makes automatable exploitation implausible (requires social engineering per target). The signals are consistent, not conflicting: medium technical impact (code execution in the context of the current user process, VA:H but VC:L/VI:L) combined with very low exploitation probability. Bottom line: a legitimate bug worth patching on standard cycles, but not a drop-everything issue - real priority is LOW-to-MEDIUM, driven by the local, user-interaction-gated vector rather than by any exploitation evidence.

An attacker crafts a malicious DIAScreen project or data file and delivers it to an engineer or operator via email, a shared drive, or a compromised project repository. When the victim opens the file in DIAScreen (version prior to 1.6.1), the parser performs an out-of-bounds write, allowing the attacker to execute arbitrary code in the context of the current user's process. No public proof-of-concept or exploit code was identified in the provided data, and exploitation requires the victim to actively open the attacker's file.