This vulnerability arises from improper validation of user-supplied data during the parsing of PDSPRJ project files in Labcenter Electronics Proteus 8.17 SP5. The type confusion condition (CWE-843) can be triggered remotely when a user opens a crafted file or visits a malicious page, enabling execution of arbitrary code with the privileges of the Proteus process. The CVSS v3.0 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed as of the publication date.

Successful exploitation can lead to remote code execution in the context of the current user running Proteus, potentially allowing an attacker to fully compromise the affected system. Confidentiality, integrity, and availability of the system and data may be severely impacted. Exploitation requires user interaction, limiting the attack vector to scenarios where a user opens a malicious file or visits a malicious page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening PDSPRJ files from untrusted sources and be cautious about visiting untrusted web pages that could deliver malicious files. Monitor vendor communications for updates on patches or mitigations.