Cncsoft EUVD-2025-16849

The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates moderate real-world exploitability: local attack vector limits scope to users with system access, low complexity means straightforward exploitation once file validation is bypassed, low privilege requirement means standard users can trigger it, and the critical user interaction requirement (UI:R) necessitates social engineering. The high confidentiality, integrity, and availability impact scores reflect the severity of arbitrary code execution. Without access to EPSS score and KEV status data in the provided information, risk cannot be fully quantified, but the industrial control system (ICS) context elevates concern—CNCSoft vulnerabilities can affect manufacturing floor safety and production continuity. The combination of local-only access vector and required user interaction moderates the risk compared to remote vulnerabilities, but in manufacturing environments where operators frequently exchange CAM files and project files, social engineering is feasible. This warrants immediate patching for organizations running CNCSoft, particularly in critical manufacturing operations.

A manufacturing engineer receives a CNCSoft project file via email or shares it via a network drive, purportedly from a colleague or supplier containing updated CNC machining instructions. The file has been crafted by an attacker to contain malformed geometry data or corrupt metadata that bypasses CNCSoft's file validation routines. When the engineer opens the file in CNCSoft (user interaction—the required attack prerequisite), the application attempts to parse the malicious content. Due to insufficient bounds checking in the file parsing code (CWE-787), the malformed data causes a buffer overflow, allowing the attacker's embedded shellcode to execute in the context of the CNCSoft process. The attacker gains the ability to: read sensitive CAM programs and manufacturing specifications; modify CNC machine instructions to cause defective parts or equipment damage; install persistence mechanisms; exfiltrate intellectual property. Attack complexity is low because the attacker only needs to craft a single malicious file and rely on social engineering; no advanced exploitation techniques or system-specific knowledge is required beyond understanding CNCSoft file formats.