ZDI-CAN-28415: ZDI-26-151: Delta Electronics CNCSoft-G2 DPAX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Mar 6, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-3094.

Affected Software

1 affected component

Delta Electronics CNCSoft-G2

Event History

Mar 6, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28415?

The severity of ZDI-CAN-28415 is high due to its potential for remote code execution.

How do I fix ZDI-CAN-28415?

To fix ZDI-CAN-28415, ensure you update the Delta Electronics CNCSoft-G2 software to the latest version provided by the vendor.

What exploit is associated with ZDI-CAN-28415?

ZDI-CAN-28415 allows remote attackers to exploit an out-of-bounds write vulnerability for arbitrary code execution.

Is user interaction required to exploit ZDI-CAN-28415?

Yes, user interaction is required to successfully exploit ZDI-CAN-28415.

What software is affected by ZDI-CAN-28415?

ZDI-CAN-28415 affects installations of Delta Electronics CNCSoft-G2.