The vulnerability CVE-2025-49848 affects LS Electric GMWin 4 version 4.18 and involves an out-of-bounds write during the parsing of PRJ files. The root cause is insufficient validation of user input, which can lead to memory corruption by reading or writing past the boundaries of allocated data structures. The CVSS 4.0 base score is 8.4 (high), reflecting local attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The product is not a cloud service, and no patch or vendor advisory is currently provided.

Successful exploitation of this vulnerability can result in memory corruption, potentially allowing an attacker to alter program behavior, cause crashes, or execute arbitrary code with the privileges of the user running the application. The high CVSS score indicates significant impact on confidentiality, integrity, and availability. However, exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening PRJ files from untrusted sources and restrict access to the affected software to trusted users only.