A high-severity out-of-bounds write vulnerability in Schneider Electric IGSS Definition poses a risk of data loss or arbitrary code execution through specially crafted CGF files.

This issue is an out-of-bounds write vulnerability (CWE-787) triggered when the application processes a malicious CGF file. The vulnerability requires user interaction to import the malformed file, but it does not require authentication.

Successful exploitation of this vulnerability could lead to total compromise of the host system, including unauthorized code execution and significant data loss. Given the CVSS score of 8.4, this flaw presents a substantial risk to operational integrity, particularly in industrial environments where IGSS is deployed.

Immediate Action: Users must consult the official Schneider Electric security notice (SEVD-2026-195-01) and apply the latest vendor-supplied updates or patches as soon as they become available.

Proactive Monitoring: Security teams should monitor system access logs for unusual activity related to the IGSS Definition application and restrict the ability of users to import files from untrusted or external sources.

Compensating Controls: Implement strict file-type validation or sandboxing for imported files to prevent the processing of malicious CGF content.

Public Exploit Available: Unknown.

The high severity of this vulnerability necessitates immediate attention. Administrators should prioritize identifying all instances of the affected software and applying the vendor-recommended security updates to prevent potential code execution scenarios.