What’s Vulnerable › Vulnerabilities

CVE-2025-49848: Out-of-bounds Write in LS Electric GMWin 4

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-17 · updated 2026-06-17
• Weakness: CWE-787

Description

An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data structures.

Affected products

• LS Electric GMWin 4: Version 4.18

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-168-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-02
• https://www.ls-electric.com/support

Get alerted when CVE-2025-49848 or the next vulnerability affects your stack