CVE-2025-22883 is a high severity (CVSS 7.8) out-of-bounds write in Delta Electronics ISPSoft 3.20. Opening a crafted DVP project file can let an attacker execute arbitrary code on the engineering workstation. Delta's advisory directs users to update to ISPSoft v3.21 or later and lists no workaround.
What's affected
Delta Electronics advisory Delta-PCSA-2025-00004 covers ISPSoft version 3.20 and prior. It was published on 16 April 2025 and last updated on 30 April 2025. It lists the mitigation as downloading and updating to ISPSoft v3.21 or later, and says there is no workaround.
The advisory groups several CVEs by weakness type: stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787). The CVSS vector for this CVE is AV:L/AC:L/PR:N/UI:R, so the attacker needs the victim to open a malicious file locally. It is not a network service flaw.
How to check if you're exposed
Open ISPSoft and check the version in the About dialog, or look at the installed programs list on the engineering workstation. Version 3.20 and earlier are affected.
Then find where project files come from. Engineering laptops often receive files from integrators, vendors and email. Those are the files that need caution until the update is in place.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Download ISPSoft v3.21 or later from the Delta download center.
- Install the update on every engineering workstation that has ISPSoft.
- Until then, open project files only from trusted sources and avoid unsolicited attachments, as Delta advises.
- Keep control systems off the internet and behind a firewall, separated from the business network, as the advisory recommends.
- Use a VPN for remote access to engineering networks.
Why it matters
CWE-787 describes writing data outside the intended memory buffer. The NVD text for this CVE is brief: parsing a DVP file leads to an out-of-bounds write that could allow arbitrary code execution. The advisory does not give more detail, and this guide does not guess at it.
DVP is a project file format used with Delta's DVP series controllers. In practice, project files get shared between engineers, integrators and vendors, which makes them a natural delivery route. Treat every file that arrives from outside as untrusted until the update is installed. The record does not mark exploitation, and the KEV flag is false.
Quick check
Which version is fixed?
ISPSoft v3.21 or later, according to the Delta advisory.
Does this need network access?
No. The CVSS vector is local with user interaction, so the user has to open the file.
Sources
- Delta Electronics advisory Delta-PCSA-2025-00004, ISPSoft multiple vulnerabilities (v1)
- Delta Electronics advisory Delta-PCSA-2025-00004, ISPSoft multiple vulnerabilities (v2)
Last reviewed: 19 October 2026.
