Labcenter Electronics Proteus 8.17 SP5 contains a remote code execution vulnerability (CVE-2026-5494) due to an out-of-bounds write in the processing of PDSPRJ files. The vulnerability is caused by insufficient validation of user-supplied data, which allows writing beyond the allocated buffer boundary. An attacker can exploit this by delivering a crafted PDSPRJ file that, when opened by a user, triggers arbitrary code execution within the context of the Proteus process. The CVSS v3.0 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Exploitation requires user interaction and local access vector. No official patch or vendor advisory is currently available.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the user running Proteus, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. Since user interaction is required, the risk is mitigated by user caution but remains significant due to the high impact of code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening PDSPRJ files from untrusted sources and be cautious about visiting untrusted web pages that might deliver malicious files. Monitor vendor communications for updates on patches or official mitigations.