Cncsoft EUVD-2025-16846

CVSS 7.3 (High) reflects significant exploitability: local attack vector (AV:L) limits exposure to users with file system access, but low attack complexity (AC:L) and low privilege requirements (PR:L) mean any local user can trigger exploitation. The requirement for user interaction (UI:R) to open a malicious file moderately reduces risk in automated environments but increases risk in environments where users routinely open external files. No KEV/CISA known exploitation confirmation is documented here, and no public POC availability is indicated, reducing immediate real-world exploitation probability. However, the straightforward nature of the vulnerability (file validation bypass leading to code execution) suggests a POC could be developed by skilled threat actors. The moderate EPSS score baseline for this CVSS/CWE combination suggests real but not imminent exploitation risk. In industrial/manufacturing contexts where CNCSoft is used, the impact is amplified due to potential physical safety implications and operational technology (OT) criticality. This is a legitimate priority for affected organizations but not an emergency without confirmed exploitation.

A manufacturing engineer receives an email containing a 'machine setup file' (.cnc, .gcode, or proprietary format) purportedly from a supplier or colleague. The file is actually crafted by an attacker to contain malicious binary data in file header or parameter fields that triggers an out-of-bounds write when parsed by CNCSoft. When the engineer opens the file in CNCSoft to review or load machine parameters, the parser reads beyond allocated buffer boundaries and writes attacker-controlled data to adjacent memory regions. This corrupts the application heap or stack, potentially overwriting a function pointer or return address. The attacker's payload redirects execution to injected machine code, granting the attacker code execution privileges equivalent to the engineer's local user account. From there, the attacker could steal CAD/CAM files, modify machine control logic, or pivot to other networked systems. No public POC is currently known, but the simplicity of file validation bypass vulnerabilities suggests one could be developed within days to weeks of public disclosure.