Executive brief
Easy Grade Pro, a software tool used by educators to manage student grades and records, is vulnerable to a flaw when opening specially crafted files. If a teacher or administrator opens a malicious .EGP gradebook file provided by an attacker, the application will crash. This results in a denial-of-service, preventing the user from accessing their grading data until the application is restarted and the problematic file is avoided.
Technical details
A logic flaw exists in the parsing of proprietary .EGP gradebook files in Easy Grade Pro 4.1.0.2. By modifying specific fields at precise offsets within a valid .EGP file, an attacker can trigger an out-of-bounds (OOB) memory read (CWE-125). The vulnerability is triggered when a user is induced to open the malformed file, resulting in an unhandled access violation and a local denial-of-service (DoS) condition. The attack requires user interaction (UI:R) to open the malicious file locally. A Proof of Concept (PoC) has been disclosed for educational purposes.
Affected products
- Orbis Software Easy Grade Pro 4.1.0.2
Timeline
- 2026-03-11: advisory: Initial disclosure of CVE-2025-70330
- 2026-03-11: disclosed: Vulnerability details and PoC published on GitHub