CVE-2026-5494

CVE-2026-5494 is an out-of-bounds write vulnerability in Labcenter Electronics Proteus that allows remote attackers to execute arbitrary code through malicious PDSPRJ files. The flaw stems from insufficient validation of user-supplied data during file parsing, enabling attackers to write past allocated buffer boundaries. This vulnerability affects installations of Proteus and requires user interaction, such as opening a malicious file or visiting a compromised webpage. The vulnerability carries a HIGH severity rating with a CVSS score of 7.8. It requires local attack vector and low complexity with no privilege escalation needed, though user interaction is mandatory. The impact is severe, with high confidentiality, integrity, and availability consequences, allowing attackers to execute arbitrary code within the context of the affected process. There is currently no evidence of active exploitation or public availability of functional exploit code. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog and is inactive on public hot lists. However, the FAUCET Risk Score of 49.0 indicates moderate community concern regarding this vulnerability, warranting monitoring and timely patching of affected systems.