A critical out-of-bounds write vulnerability in Labcenter Electronics Proteus allows remote attackers to execute arbitrary code via specially crafted PDSPRJ files.

This vulnerability is an out-of-bounds write (CWE-787) flaw triggered during the parsing of PDSPRJ files. An unauthenticated attacker can achieve remote code execution if a user is tricked into opening a malicious file.

The ability for an attacker to execute arbitrary code on a target system poses a severe risk to confidentiality, integrity, and availability. With a CVSS score of 7.8, this vulnerability represents a significant threat to organizational security, potentially leading to total system compromise, data exfiltration, or the installation of persistent malware.

Immediate Action: Users should exercise extreme caution when opening unsolicited PDSPRJ files from untrusted sources and await an official security patch from Labcenter Electronics.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious process spawning behavior related to the Proteus application.

Compensating Controls: Implement file integrity monitoring and restrict the execution of untrusted software through application allow-listing policies to reduce the attack surface.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the potential for remote code execution, this vulnerability should be prioritized for mitigation by restricting the handling of external project files. Organizations should monitor vendor communications for the release of a security patch and apply it immediately upon availability to eliminate the underlying buffer overflow risk.