CVE-2023-43819 is a high severity (8.8) buffer overflow in Delta Electronics DOPSoft version 2, triggered when it parses the InitialMacroLen field of a DPS file. The vendor says the product is end-of-life with no patch, so stop opening untrusted DPS files and plan a replacement.
What's affected
The record names one product, Delta Electronics DOPSoft, part of Delta Industrial Automation. The description says version 2 for most of this family of CVEs, and the Exodus Intelligence write-up names DOPSoft version 2. The record's machine readable data lists no version bounds.
There is no fixed version. The Exodus Intelligence page quotes the vendor statement that the affected product is end-of-life and no patches are available. Exodus disclosed the issue to the vendor on 8 March 2023, the vendor responded on 22 March 2023, and Exodus published on 18 January 2024. Its tracking ID for this issue is EIP-2ac577d8.
The sources disagree on the score, because they use different CVSS versions. NVD gives 8.8 (High) under CVSS 3.1. Exodus Intelligence gives a CVSS version 2 score of 6.8 with the vector AV:N/AC:M/Au:N/C:P/I:P/A:P. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms the attack is made over the network, attack complexity is low, it needs no privileges, and it needs a user to take an action such as opening a file. Impact on confidentiality is high, on integrity high and on availability high. The record calls it a stack based buffer overflow.
The weakness is tagged CWE-119, CWE-120.
How to check if you're exposed
DOPSoft is Windows desktop software, so there is no package manager query that is sure to find it. List installed programs and look for it:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*DOPSoft*' | Select-Object DisplayName, DisplayVersion
Also check engineering workstations, shared project folders and jump hosts, since these are where DPS project files get opened. If your software inventory or SBOM tracks engineering tools, search it for DOPSoft.
What to do now
- Find every machine where DOPSoft is installed and note the version.
- Stop opening DPS files from email, downloads, vendor portals or removable media unless you trust the source and have checked the file.
- Restrict who can place project files on the engineering workstation, and keep those workstations away from the internet and email.
- Plan a move to a supported Delta tool. The vendor says no patch will come for DOPSoft.
- Back up your project files and keep a known good copy so you can rebuild a workstation quickly.
Why it matters
CWE-119 is improper restriction of operations within the bounds of a memory buffer. The code performs operations on a buffer without keeping them inside its bounds. It is the parent class of reads and writes outside a buffer. CWE-120 is buffer copy without checking size of input (classic buffer overflow). The code copies data into a buffer without confirming the data fits. Extra bytes spill into neighbouring memory.
This bug sits in the file parser. The program trusts a length value inside the DPS file and copies data based on it without a proper bounds check. The advisory describes the result as code execution in the context of the person who opened the file.
Because the attacker has to get a user to open a file, the realistic risk is an engineering workstation that handles files from outside. That workstation often has network access to the machines that run a plant. The record does not mark this CVE as a CISA Known Exploited Vulnerability, and the Exodus page does not report exploitation in the wild.
Quick check
Is there a fix for this DOPSoft flaw?
No. The vendor statement quoted by Exodus Intelligence says the product is end-of-life and no patches are available.
Why do two scores differ?
NVD uses CVSS 3.1 and gives 8.8. Exodus Intelligence quotes a CVSS version 2 score of 6.8. They are different scales, so compare each only within its own version.
Sources
Last reviewed: 19 October 2026.
