EUVD-2026-40266
GHSA-qrm2-gj4m-7475
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious DTMSoft project file
-
DeliveryDeliver file to engineer (email/USB/share)
-
ExploitVictim opens file in DTMSoft
-
ExecutionUntrusted data deserialized
-
ImpactArbitrary code executes as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted DTMSoft project file inside DTMSoft - the vulnerable code path is the project-file parsing/deserialization routine, so a triggering file must be delivered to and opened by a user (consistent with AV:L and UI:A). No authentication or prior privileges are needed to author the malicious file (PR:N), but the attack cannot proceed without user interaction and local file access; it is not remotely exploitable over a network and does not work against a system where no one opens the attacker-supplied file. The practical limiting factors are therefore the need for social engineering or file-delivery to an operator and the local attack vector. |
| Impact | The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, base 8.4) and its CVSS 3.1 equivalent both characterize this as a high-severity but user-interaction-dependent, locally-vectored issue - it is not a remotely auto-exploitable service bug. UI:A (passive/active user interaction required) and AV:L mean an attacker must convince a victim to open a malicious project file, which substantially limits mass exploitation despite the full C/I/A impact. No EPSS probability, SSVC decision, KEV entry, or public POC was provided, so there is no signal of active or automatable exploitation; the realistic risk is targeted social-engineering or supply-of-malicious-file scenarios against engineering workstations. Note a consistency point: PR:N is reported, so no authentication is required to weaponize the file, but exploitation still hinges on the victim's action - defenders should weigh that interaction requirement heavily rather than treating the 8.4 score as a remotely wormable threat. |
| Exploit ScenarioDerived | An attacker crafts a DTMSoft project file containing a malicious serialized object graph and delivers it to an engineer via email, a shared drive, or a USB stick posing as a legitimate configuration. When the engineer opens the file in DTMSoft, the embedded data is deserialized and arbitrary code executes with the user's privileges on the engineering workstation. No public exploit is currently identified, so this remains a plausible targeted-social-engineering vector rather than a commodity attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Arbitrary code execution in Delta Electronics DTMSoft arises from unsafe deserialization of untrusted data during project file parsing (CWE-502), allowing an attacker who supplies a malicious DTMSoft project file to run code in the context of the user who opens it. The flaw is local and requires victim interaction (opening the crafted file) rather than remote network exploitation, and impacts confidentiality, integrity, and availability fully. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; no EPSS score was supplied.
RemediationAI
Patch available per vendor advisory: apply the fixed DTMSoft release identified in Delta-PCSA-2026-00010 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00010_DTMSoft%20Project%20File%20Parsing%20Deserialization%20of%20Untrusted%20Data%20Remote%20Code%20(CVE-2026-12578)_v1.0.pdf); an exact fixed version number was not included in the structured data and must be taken from that PDF. Until patched, treat DTMSoft project files as untrusted: only open project files from known, verified sources and never open files received by email, download, or removable media of unknown origin (trade-off: disrupts legitimate file sharing among integrators). Restrict DTMSoft to dedicated, network-segmented engineering workstations and apply application allowlisting so unexpected child processes spawned from DTMSoft are blocked (trade-off: requires baselining legitimate behavior). Where feasible, run the software under a least-privileged account to limit the impact of code executing as the opening user.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DTMSoft is Delta Electronics' DTM (Device Type Manager) engineering/configuration software used in industrial automation toolchains. The vulnerability is a CWE-502 Deserialization of Untrusted Data weakness in the routine that parses DTMSoft project files: the application reconstructs objects from serialized data embedded in a project file without validating type or content, letting an attacker embed a malicious object graph that executes code (gadget-chain style) when the file is deserialized. The affected CPE is cpe:2.3:a:deltaww:dtmsoft (all versions enumerated by the advisory), confirming this is an application-layer file-handling flaw rather than a network service issue.
Know when Dtmsoft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File-parsing deserialization needs a victim to open a malicious local file (AV:L, UI:R) with no attacker auth (PR:N); successful RCE yields full C/I/A impact.
Primary rating from Vendor (Deltaww).
CVSS VectorVendor: Deltaww
DescriptionCVE.org
The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.
Zero Day Initiative Advisories
Executive ViewAI
Delta Electronics DTMSoft users face a high-severity code execution vulnerability (CVE-2026-12578) triggered by opening a malicious project file, potentially giving attackers full system control. Organizations relying on DTMSoft for engineering or operational workflows are at direct risk through social engineering and file-distribution attacks. Immediate user restrictions and file-level monitoring are critical until the vendor releases a patch.
Pending vendor patch availability: (1) User and email security controls to prevent malicious DTMSoft project files from reaching endpoints; (2) File-type filtering and scanning at perimeter and endpoint to block DTMSoft files from untrusted origins; (3) Process and network behavior monitoring to detect exploitation attempts; (4) Network segmentation to contain and limit lateral movement from any compromised DTMSoft system; (5) Restrict DTMSoft operation to isolated systems or non-critical engineering environments where business-continuity risk is acceptable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB