Delta DIAScreen CVE-2025-59300

Exploitation requires a victim to actively open an attacker-crafted malicious file within the Delta Electronics DIAScreen application (versions before 1.6.1); the flaw lies in DIAScreen's file-parsing routine, which fails to validate user-supplied file contents and performs an out-of-bounds write. Key LIMITING factors: the vector is local (AV:L) and NOT network-reachable, so the attacker cannot trigger it remotely; mandatory user interaction (UI:A) means the attack fails unless an operator is socially engineered into opening the malicious file; and systems patched to DIAScreen 1.6.1 or later are not affected. There is no server-side or unattended exploitation path - it is strictly a client-side 'open a file' vulnerability on engineering workstations.

This is a medium-severity, client-side memory-corruption flaw whose real-world risk is low despite code-execution potential. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) describes local exploitation that is NOT remotely reachable and REQUIRES active user interaction - the victim must open an attacker-supplied malicious file, which fundamentally caps weaponizability. EPSS strongly corroborates low urgency at 0.02% (3rd percentile), indicating negligible observed/predicted exploitation. There is no CISA KEV listing and no public exploit identified, so this is not confirmed to be actively exploited. The SSVC-style read is: exploitation = none observed, automatable = no (requires per-victim social engineering to open a file), technical impact = total only for availability (VA:H) with limited confidentiality/integrity (VC:L/VI:L). Signals are internally consistent - low EPSS, no KEV, no POC, local+UI vector all point the same direction, so there is no conflict to resolve. Note the PR:N in the CVSS vector means no authentication is needed, but exploitation still hinges entirely on user interaction rather than on network access, so raw 'unauthenticated' framing overstates reachability. Net: a legitimately patchable issue for DIAScreen operators, but a routine-patch-cycle item, not an emergency.

An attacker crafts a malformed DIAScreen project/configuration file that triggers an out-of-bounds write during file parsing (CWE-787) and delivers it to an engineering workstation operator via email, a shared drive, or a compromised project repository. When the operator opens the file in a vulnerable DIAScreen version (<1.6.1), the parser corrupts memory and the attacker achieves code execution in the context of the DIAScreen process. No public exploit code is known, and the local vector plus required user interaction (AV:L/UI:A) mean the attacker depends on social engineering to get the file opened.