CVE-2026-5495

CVE-2026-5495 is a remote code execution vulnerability affecting Labcenter Electronics Proteus that stems from improper validation of user-supplied data during PDSPRJ file parsing, allowing attackers to write past the end of an allocated buffer and execute arbitrary code. The vulnerability requires user interaction, as targets must open a malicious file or visit a malicious page to trigger exploitation. The attack vector is local with low complexity and no required privileges, resulting in a CVSS score of 7.8 (HIGH) with potential impacts to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA KEV catalog, and it maintains an inactive status on the Exploit Hot List. The extremely low EPSS score of 0.0006 and moderate FAUCET Risk Score of 49.0 suggest limited immediate threat landscape activity, though organizations running Proteus should apply patches when available to mitigate this moderate-to-high severity risk.