Executive brief
Labcenter Electronics Proteus is a software suite used for electronic design automation and circuit simulation. A security flaw in how the application handles project files could allow an attacker to take control of a user's computer if the user is tricked into opening a specially crafted malicious file. This could lead to the theft of sensitive design data or the installation of unauthorized software.
Technical details
An out-of-bounds (OOB) write vulnerability (CWE-787) exists within the PDSPRJ file parsing component of Labcenter Electronics Proteus. The root cause is a lack of proper validation of user-supplied data within the project file, which allows a write operation to occur past the end of an allocated buffer. While categorized as a remote code execution threat, the attack vector is local/user-interaction-dependent, requiring a target to open a malicious file or visit a malicious page. Successful exploitation allows for arbitrary code execution in the context of the current process. The vendor has indicated the software is no longer in production, and no official patch is available; users are advised to restrict interaction with untrusted PDSPRJ files.
Affected products
- Labcenter Electronics Proteus 8.17 SP5
Timeline
- 2025-04-14: disclosed: Vulnerability reported to vendor by ZDI
- 2026-04-06: advisory: Zero Day Initiative published advisory ZDI-26-255
- 2026-04-11: other: CVE published to NVD