The flaw lies in Proteus' handling of PDSPRJ project files. When data supplied by a user is not validated, a type‑confusion condition can be triggered, allowing an attacker to supply a crafted file that the program interprets as a different data type. This leads to execution of arbitrary code in the process context of Proteus. The vulnerability is only exploitable when the user opens or otherwise processes a malicious PDSPRJ file.

All versions of Labcenter Electronics Proteus that parse PDSPRJ files are affected. No specific release range is provided, so every publicly available version that supports this file format should be regarded as vulnerable until a vendor update is issued.

The CVSS score of 7.8 denotes high severity. The attack requires user interaction, i.e., the victim must open a malicious PDSPRJ file or visit a page that triggers parsing. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the combination of high severity and the need for user cooperation means that environments where users routinely import third‑party project files are at risk of arbitrary code execution.