Delta ISPSoft CVE-2026-105228

Exploitation requires an ISPSoft user to actively open or load an attacker-crafted file in the application (UI:A in the vendor vector), triggering the out-of-bounds read during parsing - it is NOT remote unauthenticated exploitation against a listening service. No authentication is required of the attacker (PR:N), but the mandatory user interaction and the engineering-workstation deployment model (ISPSoft is typically run by OT/automation engineers, not exposed to the internet) are the key limiting factors. Risk is confined to environments where engineers process untrusted project files; the primary impact is application crash (availability) with limited memory disclosure.

This is a moderate-priority client-side vulnerability, not an urgent internet-facing emergency. The CVSS 4.0 base score of 7.0 is driven primarily by high availability impact (VA:H) with only low confidentiality impact (VC:L) and no integrity impact - consistent with an out-of-bounds read (CWE-125) that leaks small amounts of memory and/or crashes the application. Critically, the vendor vector requires user interaction (UI:A), meaning a victim must actively open or process attacker-supplied content in ISPSoft; this materially reduces real-world risk versus a true unauthenticated remote exploit, despite the AV:N labeling. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation - this appears to be a vendor-reported (Deltaww) advisory finding rather than an opportunistically exploited flaw. The AV:N in the vendor vector is in tension with the file/engineering-tool nature of ISPSoft (a PLC programming workstation application); delivery is remote only in the sense that a malicious project file can be sent to an operator, so the practical attack vector is local file-opening - verify against the Delta PCSA-2026-00016 advisory. Net: patch during normal OT maintenance cycles; this is a high-CVSS-but-interaction-gated issue, not a wormable remote bug.

An attacker crafts a malicious ISPSoft project or related file and delivers it to an engineer (via email, shared drive, or compromised project repository). When the engineer opens the file in Delta ISPSoft, the out-of-bounds read is triggered, disclosing adjacent process memory and/or crashing the engineering workstation (high availability impact). No public exploit code was identified at time of analysis, and user interaction is required, so exploitation depends on social engineering of an ICS engineer.