Loading story…
Zero Day Initiative disclosed two zero-day vulnerabilities in Labcenter Electronics Proteus that can lead to remote code execution when the application parses a malicious PDSPRJ project file. The flaws are tracked as CVE-2026-5493 (ZDI-26-255, ZDI-CAN-25718) and CVE-2026-5496 (ZDI-26-254, ZDI-CAN-25717), with both assigned a CVSS 7.8 score. One issue stems from an out-of-bounds write, while the other is caused by type confusion due to improper validation of user-supplied data.
Exploitation requires user interaction, such as opening a crafted file or visiting a malicious page, after which arbitrary code may run in the context of the current process. ZDI said it reported the issues to the vendor in April 2025, but Labcenter later indicated the software and installer were no longer in production. After seeking an end-of-life announcement and notifying the vendor of its intent to disclose, ZDI published both cases as zero-day advisories.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-06, ZDI published an advisory for Labcenter Electronics Proteus flaw CVE-2026-5494 / ZDI-26-256, a PDSPRJ file parsing out-of-bounds write that can lead to remote code execution. The issue requires user interaction, such as opening a malicious file or visiting a malicious page, and was disclosed as a zero-day after the vendor said the affected software was no longer in production.
On April 6, 2026, ZDI published zero-day advisories for two Labcenter Electronics Proteus vulnerabilities in PDSPRJ file parsing. The issues, CVE-2026-5493 and CVE-2026-5496, can allow arbitrary code execution if a user opens a malicious file or visits a malicious page.
After receiving the reports, the vendor told ZDI that the affected Proteus software and installer were no longer in production. ZDI then sought an end-of-life announcement and notified the vendor of its intent to disclose.
Zero Day Initiative reported a Labcenter Electronics Proteus remote code execution vulnerability involving PDSPRJ file parsing to the vendor. The flaw was later tracked as CVE-2026-5493 / ZDI-26-255 and stemmed from an out-of-bounds write.
In April 2025, Zero Day Initiative reported another Labcenter Electronics Proteus remote code execution vulnerability involving PDSPRJ file parsing. The flaw was later tracked as CVE-2026-5495 / ZDI-26-257 and was caused by an out-of-bounds write due to improper validation of user-supplied data.
In April 2025, ZDI also reported a second Proteus PDSPRJ file parsing remote code execution issue to Labcenter Electronics. This separate flaw was later tracked as CVE-2026-5496 / ZDI-26-254 and involved a type confusion condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
zerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Digilent DASYLab received fixes for two remotely exploitable vulnerabilities, `CVE-2026-0957` and `CVE-2026-0954`, disclosed by the Zero Day Initiative as `ZDI-26-235` and `ZDI-26-236`. The flaws affect the parsing of DASYLab `DSA` and `DSB` files and stem from insufficient validation of user-supplied data, resulting in out-of-bounds writes that can let an attacker execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as convincing a target to open a malicious file or visit a malicious page that triggers the vulnerable parsing logic. Both issues were assigned a `CVSS` score of `7.8`, with potential impact to confidentiality, integrity, and availability, and Digilent issued updates to remediate the vulnerabilities following coordinated disclosure; one of the findings was credited to Rocco Calvi of TecSecurity.
Jun 29, 2026
Digilent has addressed two **remote code execution** vulnerabilities in **DASYLab** that were publicly disclosed by the Zero Day Initiative as `ZDI-26-233` and `ZDI-26-234`, mapped to `CVE-2026-0955` and `CVE-2026-0956`. Both flaws stem from improper validation of user-supplied data while parsing **DSA files**, leading to an **out-of-bounds read** that can be leveraged for arbitrary code execution in the context of the current process. Exploitation requires user interaction, including opening a malicious file or visiting a malicious page, and each issue carries a **CVSS 7.8** severity rating. Digilent released updates to remediate the vulnerabilities, and both disclosures credit **Rocco Calvi of TecSecurity** for reporting the issues.
Jun 29, 2026
**Delta Electronics CNCSoft-G2** contains an out-of-bounds write vulnerability in the *DOPSoft* component’s **DPAX file parsing** that can lead to **remote code execution** in the context of the current process. The issue is tracked as **CVE-2026-3094** (ZDI-CAN-28415 / **ZDI-26-151**) and is rated **CVSS 7.8 (High)** with the vector `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`; exploitation requires **user interaction** (e.g., opening a malicious file or visiting a malicious page that triggers processing of attacker-controlled content). Affected versions are **CNCSoft-G2 prior to V2.1.0.39** (CWE-787), and Delta Electronics has issued an update to remediate the flaw. CISA’s ICS advisory highlights the potential impact to **critical manufacturing** environments and recommends standard OT hardening measures, including minimizing network exposure of control system assets, placing devices behind firewalls and isolating OT from business networks, and using more secure remote access methods (e.g., VPNs) when remote connectivity is required. Separately, CISA also added **Hikvision CVE-2017-7921** and **Rockwell Automation CVE-2021-22681** (both **CVSS 9.8**) to the **Known Exploited Vulnerabilities (KEV)** catalog due to evidence of active exploitation; this KEV action is unrelated to the Delta Electronics CNCSoft-G2 disclosure and represents a different set of exploited product vulnerabilities requiring separate remediation prioritization.
Jun 29, 2026