Which versions of Delta DTMSoft are affected by CVE-2026-12578?

Delta Electronics DTMSoft users face a high-severity code execution vulnerability (CVE-2026-12578) triggered by opening a malicious project file, potentially giving attackers full system control.

How to fix or mitigate CVE-2026-12578?

24 hours: Inventory all DTMSoft installations and affected user populations; issue mandatory security alert prohibiting users from opening DTMSoft project files from external, untrusted, or unexpected sources; enable antivirus scanning for DTMSoft-related files and processes. 7 days: Block DTMSoft project file types at email gateways, cloud storage, and file-sharing platforms (reject from external domains); deploy endpoint behavior monitoring to detect DTMSoft spawning unexpected child processes or accessing sensitive resources. 30 days: Monitor Delta Electronics security advisories for CVE-2026-12578 patch release; prepare and test staged patch rollout plan; conduct security awareness training emphasizing file-based attack vectors and social engineering risks.

Delta DTMSoft CVE-2026-12578

Q: What is the CVSS score of CVE-2026-12578?

CVE-2026-12578 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40266 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 Deltaww

GHSA-qrm2-gj4m-7475

RCE Deserialization Dtmsoft Deltaww

8.4

CVSS 4.0 · Vendor: Deltaww

Severity by source

Vendor (Deltaww) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

File-parsing deserialization needs a victim to open a malicious local file (AV:L, UI:R) with no attacker auth (PR:N); successful RCE yields full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Deltaww).

CVSS VectorVendor: Deltaww

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 08:59 vuln.today

DescriptionCVE.org

The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.

AnalysisAI

Arbitrary code execution in Delta Electronics DTMSoft arises from unsafe deserialization of untrusted data during project file parsing (CWE-502), allowing an attacker who supplies a malicious DTMSoft project file to run code in the context of the user who opens it. The flaw is local and requires victim interaction (opening the crafted file) rather than remote network exploitation, and impacts confidentiality, integrity, and availability fully. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; no EPSS score was supplied.

Technical ContextAI

DTMSoft is Delta Electronics' DTM (Device Type Manager) engineering/configuration software used in industrial automation toolchains. The vulnerability is a CWE-502 Deserialization of Untrusted Data weakness in the routine that parses DTMSoft project files: the application reconstructs objects from serialized data embedded in a project file without validating type or content, letting an attacker embed a malicious object graph that executes code (gadget-chain style) when the file is deserialized. The affected CPE is cpe:2.3:a:deltaww:dtmsoft (all versions enumerated by the advisory), confirming this is an application-layer file-handling flaw rather than a network service issue.

RemediationAI

Patch available per vendor advisory: apply the fixed DTMSoft release identified in Delta-PCSA-2026-00010 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00010_DTMSoft%20Project%20File%20Parsing%20Deserialization%20of%20Untrusted%20Data%20Remote%20Code%20(CVE-2026-12578)_v1.0.pdf); an exact fixed version number was not included in the structured data and must be taken from that PDF. Until patched, treat DTMSoft project files as untrusted: only open project files from known, verified sources and never open files received by email, download, or removable media of unknown origin (trade-off: disrupts legitimate file sharing among integrators). Restrict DTMSoft to dedicated, network-segmented engineering workstations and apply application allowlisting so unexpected child processes spawned from DTMSoft are blocked (trade-off: requires baselining legitimate behavior). Where feasible, run the software under a least-privileged account to limit the impact of code executing as the opening user.