Cncsoft EUVD-2025-16850

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates moderate real-world risk: local attack vector and low complexity favor exploitation, but the requirement for local access and user interaction (UI:R) significantly constrains threat scope. The high impact scores (C:H, I:H, A:H) reflect potential for code execution, data theft, and system compromise. Without confirmed KEV (CISA Known Exploited Vulnerabilities) listing, POC availability, or EPSS data, the actual exploitation probability is uncertain—this may be a 'theoretical high-CVSS' issue with lower real-world traction, or a critical insider-threat vector. Manufacturing and industrial control environments where CNCSoft is deployed (often air-gapped or restricted-access networks) may see lower exploitation rates than standard software. Priority should be HIGH for manufacturing operations but can be MEDIUM for isolated/controlled deployments if other compensating controls exist.

A manufacturing engineer receives an email with a crafted malicious .cnc file from an attacker posing as a supplier or colleague. When the engineer opens the file in Delta CNCSoft to review the design, the application parses the file without proper bounds checking. The malicious file triggers a buffer overflow in the file parsing routine, allowing the attacker's shellcode to execute in the context of the engineer's user account (typically with local admin or elevated privileges on manufacturing workstations). The attacker gains code execution, potentially installing persistence (backdoor, rootkit), exfiltrating CAD designs or IP, or pivoting to other machines on the manufacturing network. In a targeted supply-chain attack, an attacker could compromise a design library vendor and distribute poisoned .cnc files to multiple manufacturers. No public POC is noted in current threat intelligence, but the simplicity of CWE-787 exploitation suggests POC development is straightforward once the vulnerability is disclosed. Local-only attack vector means exploitation requires prior access to a machine where CNCSoft is installed, limiting script-kiddie attacks but enabling insider threats and supply-chain targeting.