CVE-2012-10057

CVE-2012-10057 describes a buffer overflow vulnerability in Lattice Semiconductor ispVM System v18.0.2. This flaw occurs when the application processes specially crafted .xcf project files, specifically failing to validate the length of the version attribute within the ispXCF XML tag. Successful exploitation allows for arbitrary code execution under the context of the user opening the malicious file, requiring no elevated privileges. The vulnerability carries a high CVSS score of 8.4, indicating a significant risk due to its local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not actively exploited in the wild (KEV: No), a Metasploit module exists, demonstrating exploitability. Despite the available exploit code, there is minimal community discussion or media coverage surrounding this CVE, suggesting a low level of public awareness.