CVE-2026-5496

OVERVIEW CVE-2026-5496 is a remote code execution vulnerability affecting Labcenter Electronics Proteus, stemming from improper validation during PDSPRJ file parsing that results in a type confusion condition. An attacker can exploit this flaw by crafting a malicious PDSPRJ file or directing users to malicious content, enabling arbitrary code execution on vulnerable systems. This vulnerability was previously tracked as ZDI-CAN-25717. SEVERITY The vulnerability carries a CVSS 3.0 score of 7.8 (HIGH) with a local attack vector, low complexity, and no privilege requirements. While user interaction is required, successful exploitation grants the attacker high-impact capabilities including confidentiality compromise, integrity violation, and availability disruption. The attack can be executed through file-based or web-based delivery mechanisms with minimal technical barriers. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with EPSS scoring indicating a 0.0005 probability of exploitation. The vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains in an inactive status on threat intelligence hotlists. No public exploit code is readily available, suggesting limited community attention and technical analysis to date.