Delta DIAScreen CVE-2025-59299

Exploitation requires a user to actively open an attacker-crafted file in Delta Electronics DIAScreen (versions prior to 1.6.1); the malformed file triggers an out-of-bounds write in the file-parsing routine. This is the controlling precondition - there is no remote network trigger (AV:L) and no network-exposed service. Limiting factors that reduce realistic risk: mandatory user interaction (UI:A - the victim must open the file), local delivery of the file to an engineering workstation, and the fact that code executes only in the context of the current DIAScreen process rather than a privileged service. Deployments on fully patched installations (>=1.6.1) are not affected.

This is a moderate, not high-priority, issue for most environments. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:A) describes a local, user-interaction-dependent out-of-bounds write (CWE-787) - the attacker does not need prior authentication, but a legitimate user must be convinced to open a malicious file, which caps real-world exploitability. All automated-exploitation signals point low: EPSS is 0.02% (3rd percentile), there is no CISA KEV listing, and no public POC is referenced in the provided data. The vector's impact profile (VC:L/VI:L/VA:H) indicates the dominant consequence is availability (crash) with only limited confidentiality/integrity impact, which tempers the 'arbitrary code execution' framing in the description - code runs in the context of the current (typically non-privileged user) process, not as a privileged service. These signals are consistent with each other: a client-side file-parsing bug in niche ICS engineering software that requires social engineering is far better suited to targeted spear-phishing of engineers than to mass exploitation. No conflicting signals were detected, though the description's 'execute code' language is broader than the limited C/I impact the vendor-supplied CVSS vector assigns - verify exact impact with the vendor advisory.

An attacker crafts a malicious DIAScreen project/parse file and delivers it to an engineer via email, shared drive, or a compromised project repository. When the engineer opens the file in DIAScreen (versions before 1.6.1), the parser performs an out-of-bounds write, allowing the attacker to execute code in the context of that user's DIAScreen process. No public exploit code is identified at time of analysis, and exploitation requires the victim to actively open the attacker-supplied file.