Labcenter Electronics Proteus 8.17 SP5 contains a type confusion vulnerability (CWE-843) in its PDSPRJ file parser. The vulnerability results from insufficient validation of user input, allowing an attacker to craft malicious PDSPRJ files that trigger type confusion during parsing. Successful exploitation enables remote code execution with the privileges of the user running Proteus. Exploitation requires user interaction such as opening a malicious file or visiting a malicious page. The CVSS 3.0 base score is 7.8 (high severity) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No patch or official remediation has been disclosed as of the publication date.

An attacker who convinces a user to open a malicious PDSPRJ file or visit a malicious page can execute arbitrary code within the context of the Proteus process. This can lead to full compromise of the affected system with high confidentiality, integrity, and availability impact. The vulnerability requires local access or user interaction but does not require prior privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening PDSPRJ files from untrusted sources and exercise caution when browsing untrusted websites. Monitor vendor communications for updates on official patches or mitigations.