This vulnerability (CVE-2025-66586) affects AzeoTech DAQFactory 20.7 (Build 2555) and is classified as CWE-843 (Access of Resource Using Incompatible Type, or type confusion). It arises when the software parses specially crafted .ctl files, leading to memory corruption. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the DAQFactory process. The CVSS 4.0 base score is 7.3, reflecting a high severity with local attack vector, high attack complexity, no privileges required, but requiring user interaction. The vulnerability is not related to cloud services, and no official patch or vendor advisory detailing remediation is currently available.

Exploitation of this vulnerability can lead to memory corruption and arbitrary code execution in the context of the DAQFactory process. This could allow an attacker to execute malicious code locally if they can convince a user to open a malicious .ctl file. The attack complexity is high and requires user interaction, limiting the ease of exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted or specially crafted .ctl files and restrict local access to trusted users only. Monitor vendor communications for updates on patches or mitigations.