Asda Soft CVE-2026-5726

Local attacker without privileges. Victim must open a crafted file or interact with malicious input processed by ASDA-Soft application. No network access required. Default ASDA-Soft installations vulnerable when processing untrusted files.

Real-world risk is elevated for targeted industrial environments despite requiring user interaction. The CVSS 7.8 High rating reflects complete system compromise potential (C:H/I:H/A:H) with low attack complexity (AC:L) and no privileges required (PR:N). The local attack vector (AV:L) and required user interaction (UI:R) constrain casual exploitation but align with common industrial attack patterns where adversaries use social engineering or supply chain compromise to deliver malicious project files to engineering workstations. No EPSS score provided, but KEV status is not confirmed, indicating no verified active exploitation campaigns. SSVC assessment favors attention: the vulnerability is automatable once weaponized (file parsing flaws enable reliable exploitation), technical impact is total system control in industrial engineering environments with potential operational technology (OT) network access, and exploitation via malicious project files is realistic in targeted attacks against manufacturing or critical infrastructure. Priority increases significantly for organizations using ASDA-Soft in production environments, especially where engineering workstations have network connectivity to operational systems.

An attacker targeting an industrial facility crafts a malicious ASDA-Soft project file containing oversized data fields that trigger the stack buffer overflow when parsed. The attacker delivers this file via spear-phishing email to plant engineers or embeds it in compromised vendor documentation distributed through supply chain channels. When an engineer opens the malicious project file in ASDA-Soft to review servo drive configurations, the buffer overflow overwrites stack memory, redirecting execution to attacker-controlled shellcode that establishes persistence on the engineering workstation with full user privileges. From this foothold, the attacker can pivot to connected operational technology networks, exfiltrate proprietary manufacturing configurations, or manipulate servo drive parameters to disrupt production operations.