A buffer overrun vulnerability exists in Delta Electronics CNCSoft-G2, where the application fails to validate the contents of a user-supplied file during parsing. If a malicious file is opened, the overflow can be exploited to execute arbitrary code in the context of the current process, leading to potential full system compromise.

Delta Electronics CNCSoft-G2 is affected by all versions released prior to v2.1.0.39. This includes any deployments using earlier builds of the software.

Based on the description, it is inferred that the attack relies on a malicious file being opened by a legitimate user. The vulnerability has a CVSS score of 7.8, indicating high severity, but its EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The attack requires the attacker to supply a malicious file that a legitimate user opens, so the primary vector is local file import rather than remote access. Although the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, it remains a significant risk for exposed systems that process untrusted files.