Delta Electronics DOPSoft 2 Heap-based Buffer Overflow

Vulnerability

Delta Electronics DOPSoft 2 versions 2.00.07 and prior lack proper validation of user-supplied data when parsing specific project files. This failure leads to a heap-based buffer overflow (CWE-122) in the context of the current process [1].

Exploitation

An attacker must convince a user to open a specially crafted DOPSoft 2 project file. No authentication or special network position is required; the attack complexity is low and user interaction is required [1]. The crafted file triggers the heap-based overflow during parsing.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current process, leading to a complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Delta Electronics has not released a fix as of the advisory publication date. As a workaround, users should avoid opening project files from untrusted sources and apply the principle of least privilege to the DOPSoft 2 process [1].