EUVD-2025-32570Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted DIAScreen file via phishing
-
DeliveryUser opens malicious file
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionExecute code as current process
-
ImpactCompromise engineering workstation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to actively open a maliciously crafted file within Delta Electronics DIAScreen (the file-parsing routine performs the out-of-bounds write), so successful attack depends on social engineering to deliver and induce opening of the file - this is the primary limiting factor. The flaw is LOCAL only (AV:L): there is no remote or network-triggered path, and no automated/wormable propagation. Affected deployments are those running DIAScreen versions below 1.6.1; upgrading to 1.6.1 remediates. No special product configuration or feature toggle is required beyond normal use of the file-opening functionality, and no prior authentication to the application is needed (PR:N). |
| Impact | This is a moderate, exploitation-gated issue rather than an urgent priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) confirms a LOCAL attack vector requiring active user interaction - the victim must open an attacker-supplied file - so despite PR:N (no pre-existing privileges needed), this is not remotely exploitable and cannot self-propagate. EPSS is very low at 0.02% (3rd percentile), and the vulnerability is NOT in CISA KEV, with no public exploit identified; these signals are mutually consistent and point to low real-world exploitation likelihood. The base score of 6.8 is driven primarily by the VA:H (high availability impact to the vulnerable system), while confidentiality and integrity impacts are only Low (VC:L/VI:L). The signals do not conflict: a file-parsing out-of-bounds write (CWE-787) in niche engineering software, requiring social engineering to deliver and open a crafted project/configuration file, realistically translates to targeted spear-phishing against OT/engineering staff rather than broad opportunistic attacks. Priority should be patch-on-cycle, elevated for environments where DIAScreen engineers routinely open externally sourced files. |
| Exploit ScenarioDerived | An attacker crafts a malicious DIAScreen project or configuration file and delivers it to an engineering workstation operator via email or a shared drive, likely under an industrial-automation pretext. When the operator opens the file, the out-of-bounds write during parsing corrupts memory and allows code execution in the context of the DIAScreen process on the local host. No public proof-of-concept exploit has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
An out-of-bounds write in the file-parsing routines of Delta Electronics DIAScreen (versions prior to 1.6.1) allows a crafted project file to corrupt memory and execute code in the context of the DIAScreen process when a user opens it. Exploitation is local and user-interaction driven: the attacker must deliver a malicious file and induce the victim to open it, so social engineering, not network reachability, is the limiting factor - no pre-existing credentials in the application are needed (PR:N in the assessed vector), but the attack hinges on a user opening the file (UI:A, UI:R in the CVSS 3.1 assessment). Delta has published a fixed build (1.6.1), EPSS is 0.02% (3rd percentile), and no public exploit code has been identified at time of analysis.
Earlier versions of this analysis (1)
RemediationAI
Upgrade DIAScreen to version 1.6.1 or later - this is the vendor-released fix identified in the Delta PCSA-2025-00018 advisory (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf), and per EUVD the remediation threshold is exactly 1.6.1. Because the flaw only triggers when a user opens a malicious file, the strongest compensating controls are file-supply-chain and execution controls: block or quarantine DIAScreen project-file attachments at the email and web gateways and accept project files only from known engineering sources after hash verification, which reduces exposure but relies on user and mail-filter diligence rather than eliminating the bug. Run DIAScreen under a non-administrative Windows account and consider opening untrusted or externally received projects inside a VM or sandbox - the trade-off is that sandboxed or least-privilege sessions can break USB/hardware dongle access and direct PLC/HMI connectivity, so validate before wide deployment. Application allowlisting and memory-corruption protections (for example, Windows Defender Exploit Guard/ASR rules on the DIAScreen binary) add defense in depth and will typically turn a successful overflow into a crash rather than code execution, but they are not substitutes for the 1.6.1 upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write) in DIAScreen's file-parsing path, consistent with the 'Buffer Overflow' and 'Memory Corruption' tags and the advisory title describing a file parsing out-of-bounds write. DIAScreen is Delta's screen/HMI design and configuration tool; project files are structured binary containers whose fields are parsed by native code, and the parser fails to validate user-supplied length or structural data before writing into fixed-size buffers. The result is memory corruption in the parsing process: the CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H) and the independent CVSS 3.1 assessment (C:L/I:L/A:H) both indicate limited confidentiality and integrity impact with a high availability impact - in practice, a crash or unstable/terminated application, with code execution confined to the privileges of the DIAScreen process. The CPE cpe:2.3:a:deltaww:diascreen:*:*:*:*:*:*:*:* is version-wildcarded, but EUVD enumerates the affected range as DIAScreen 0 < 1.6.1, and the flaw is reachable through the normal file-open functionality with no special configuration or feature toggle required.
Know when Diascreen gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Local file-open exploitation with required user interaction (AV:L/UI:R), no privileges needed (PR:N); memory corruption yields high availability but only low confidentiality/integrity impact.
Primary rating from Vendor (759f5e80-c8e1-4224-bead-956d7b33c98b).
CVSS VectorVendor: 759f5e80-c8e1-4224-bead-956d7b33c98b
Lifecycle Timeline
5DescriptionCVE.org
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
Executive ViewAI
Delta Electronics DIAScreen contains a file validation vulnerability (CVE-2025-59297) that allows arbitrary code execution when users open malicious files, posing direct risk to any organization using this software for industrial control or monitoring. This requires user interaction but enables attackers to execute commands with the privileges of the logged-in operator, potentially compromising production systems and sensitive industrial data.
Apply vendor patch. Interim mitigations pending patch deployment: restrict DIAScreen file opening to trusted, pre-vetted files only; implement network segmentation to isolate DIAScreen systems; enforce principle of least privilege for operator accounts; monitor for suspicious file activity and process execution from DIAScreen; disable file import features if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attack
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a sta
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a sta
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a sta
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restriction
Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file.
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could all
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attack
An out-of-bounds write in Delta Electronics DIAScreen before 1.6.1 lets attackers execute code in the context of the cur
An out-of-bounds write in the file-parsing routine of Delta Electronics DIAScreen (all versions prior to 1.6.1) allows c
An out-of-bounds write in Delta Electronics DIAScreen's file-parsing routine (all versions from 0 through 1.6.1) allows
GitHub PoC
Exploit-DB