Delta Electronics CNCSoft-G2 suffers from a CWE-787 out-of-bounds write vulnerability due to insufficient validation of user-supplied files. This flaw enables an attacker to execute arbitrary code by tricking a user into opening a crafted malicious file. The vulnerability affects version 0 of the product and has a CVSS 3.1 base score of 7.8, reflecting high impact with low attack complexity and requiring user interaction. The vulnerability is publicly disclosed but no patch or fix is currently available from the vendor.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user process, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. No known exploits are reported in the wild, but the risk remains significant due to the ability to execute code remotely with user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening files from untrusted or unknown sources in CNCSoft-G2. Employing standard endpoint protections and restricting user privileges may reduce risk but do not fully mitigate the vulnerability.