CVE-2025-22882 is a high severity (CVSS 7.8) stack-based buffer overflow in Delta Electronics ISPSoft 3.20, the PLC programming software. Parsing a crafted CBDGL file can let an attacker run arbitrary code. Delta's advisory says to update to ISPSoft v3.21 or later and lists no workaround.
What's affected
Delta Electronics advisory Delta-PCSA-2025-00004 covers ISPSoft version 3.20 and prior. It was published on 16 April 2025 and last updated on 30 April 2025. It lists the mitigation as downloading and updating to ISPSoft v3.21 or later, and says there is no workaround.
The advisory groups several CVEs by weakness type: stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787). The CVSS vector for this CVE is AV:L/AC:L/PR:N/UI:R, so the attacker needs the victim to open a malicious file locally. It is not a network service flaw.
How to check if you're exposed
Open ISPSoft and check the version in the About dialog, or look at the installed programs list on the engineering workstation. Version 3.20 and earlier are affected.
Then find where project files come from. Engineering laptops often receive files from integrators, vendors and email. Those are the files that need caution until the update is in place.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Download ISPSoft v3.21 or later from the Delta download center.
- Install the update on every engineering workstation that has ISPSoft.
- Until then, open project files only from trusted sources and avoid unsolicited attachments, as Delta advises.
- Keep control systems off the internet and behind a firewall, separated from the business network, as the advisory recommends.
- Use a VPN for remote access to engineering networks.
Why it matters
CWE-787 is an out-of-bounds write. The NVD description says the code path involves debugging logic used when parsing a CBDGL file, and a stack buffer overflows. Delta's advisory classifies the group of issues as stack-based buffer overflow and out-of-bounds write.
File parsers in engineering tools matter because those tools run on workstations that are trusted to program industrial controllers. Code running on such a workstation can reach the equipment it manages. The attack here needs a user to open a file, which is why the advisory's general guidance is about untrusted links and attachments. The KEV flag in the record is false.
Quick check
What fixes CVE-2025-22882?
Delta says to update ISPSoft to v3.21 or later. Version 3.20 and prior are listed as affected.
Is there a workaround?
The advisory says no. Its general recommendations are to avoid untrusted files and links, isolate control networks and use a VPN for remote access.
Sources
Last reviewed: 19 October 2026.
