CVE-2026-12897 is an out-of-bounds read vulnerability (CWE-125) in Horner Automation's Cscape software affecting versions prior to 10.2 SP3. The vulnerability arises during the parsing of CSP files, potentially enabling attackers with high privileges to read memory beyond intended boundaries. Successful exploitation could lead to information disclosure and arbitrary code execution. The CVSS 4.0 base score is 8.4, reflecting high impact and requiring high privileges with no user interaction. No vendor advisory or patch is currently available, and the vulnerability is not related to a cloud service.

An attacker with high privileges on the affected system could exploit this vulnerability to read out-of-bounds memory, leading to information disclosure and the possibility of executing arbitrary code. This could compromise the confidentiality and integrity of the system running Cscape prior to version 10.2 SP3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor Horner Automation's advisories for updates. Restricting access to systems running vulnerable versions and limiting privileges may reduce risk until a patch is available.