CVE-2026-42953

HighCVSS 8.4/10Last modified Oct 25, 2026

Description

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Labcenter	Proteus	9.1_SP4_Build-42914

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-06

Timeline

Published: Jul 7, 2026
Last modified: Oct 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-429553.7In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family o CVE-2026-429567.1Out-of-bounds write for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an u CVE-2026-429587.8The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted fil CVE-2026-429597.5NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash CVE-2026-42968.8An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect U CVE-2026-4296010.0NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscu CVE-2026-429615.1ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a CVE-2026-429656.5A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed CVE-2026-429664.8Uncaught exception for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow an escalation CVE-2026-429685.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-429695.5Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.CVE-2026-42978.8The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. T