CVE-2026-105227

Executive Summary

CVE-2026-105227 is an out-of-bounds read (CWE-125) vulnerability in Delta ISPSoft, an industrial automation programming and configuration suite used to develop, simulate, and download PLC logic. According to the NVD description, the flaw allows remote attackers to disclose sensitive information on affected installations. The vulnerability is currently UNPATCHED (patch confidence 0/4), has no public proof-of-concept, no Nuclei template, no exploit code, and is not listed in CISA KEV. Impact is bounded by the information-disclosure nature of CWE-125, but on engineering workstations and OT network segments such disclosure can expose memory-resident credentials, licensing or configuration data, and host memory layout details useful for follow-on exploitation.

Technical Analysis

CWE-125 (Out-of-bounds Read) describes a condition in which software reads data past the end of an allocated buffer. In a binary parsing context — which is the typical exposure surface for an engineering-workstation suite such as ISPSoft — such a read occurs when a length, count, or offset field supplied by an input document is trusted and used to index a buffer without adequate bounds validation. The consequence is disclosure of adjacent heap or stack memory contents that are then returned to, or echoed back toward, the requester.

The NVD entry for CVE-2026-105227 states only that the vulnerability "allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft." It does not name a specific parser, file format, network listener, API endpoint, function, class, or parameter. Consequently, the following must be treated as class-level inference rather than confirmed implementation detail:

• Attack vector class: Remote, per the CNA/NVD text. The attacker does not require local access. "Remote" here is consistent with either (a) a crafted project/configuration file supplied to the victim, or (b) a network-reachable service component within the ISPSoft toolchain that accepts attacker-controlled input.
• Root cause class: A length or offset value read from attacker-influenced input is used to determine how many bytes to read or where to read from, without a check that the resulting access stays within the allocated buffer. The read succeeds and returns out-of-bounds bytes to the caller rather than crashing cleanly.
• Impact class: Information disclosure — not code execution. The vulnerability as described does not permit the attacker to write memory, execute code, or directly alter device state. Its value to an adversary is intelligence: memory contents that may contain secrets or that may reveal memory layout to enable a separate, more severe exploit.

Delta ISPSoft is part of Delta Electronics' industrial automation ecosystem and is commonly deployed on engineering workstations that communicate with Delta PLC and HMI families. Those workstations frequently sit on flat OT networks and commonly host project files, device credentials, and configuration exports — all of which make any read primitive on that host operationally relevant.

Two analytical caveats must be stated explicitly:

1. No CVSS vector is published. NVD does not provide a CVSS score or vector for this CVE. Any numeric severity cited elsewhere should be treated as unauthoritative. Thematically, an unauthenticated remote out-of-bounds read maps to a high Confidentiality impact with Low or None Integrity and Availability impact in the CVSS v3.1 model, but that mapping is analyst judgment, not an NVD-published value, and is presented here as such.
2. No affected-version range is published. No vendor advisory, OSV package record, or version constraint is available through the tracked sources. Operators must inventory installed ISPSoft builds directly and consult Delta for the currently supported release.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-105227 (POC_STATUS: None; Nuclei template: NO; exploit code: NO). The chain below is inferred strictly at the vulnerability-class level and does not assert specific file formats, endpoints, or function names, because none appear in the available description.

1) Reconnaissance and target identification. An attacker identifies engineering workstations running Delta ISPSoft. Because ISPSoft is an engineering tool rather than a server daemon, exposure is not necessarily internet-facing; the practical discovery surfaces are (a) OT network segments reachable after initial foothold, and (b) file-transfer channels — email, shared drives, USB media, contractor upload portals — by which a project or configuration file can be delivered to an engineer who will open it in ISPSoft. Shodan-style identification of internet-exposed instances should be treated as opportunistic rather than the primary vector.

2) Triggering the flaw class. Per the NVD description, the trigger is remote and results in an out-of-bounds read. At the class level, this means the attacker supplies input — a document the tool parses, or a request to a network-reachable component — that contains a length or offset value which is consumed without a bounds check. The parser or handler then reads beyond the end of an allocated buffer. No specific field, magic byte, or structure is asserted here, because the description does not name one.

3) Payload and execution method. No exploit payload is described. At the class level, an out-of-bounds read requires no shellcode and no memory-corruption primitive; the "payload" is simply well-formed input that positions the malformed length/offset so the read crosses the buffer boundary. Delivery is via whatever channel reaches the vulnerable parser — a crafted file opened by the engineer, or crafted input sent to the reachable service. No public exploit code demonstrates this, and no working payload is known.

4) Post-exploitation impact. Successful exploitation yields memory contents, not code execution. The disclosed bytes may contain sensitive information such as credentials, license or configuration data, or memory addresses. Two downstream risks follow: direct secret compromise, and use of leaked memory layout to improve the reliability of a separate memory-corruption vulnerability. The attacker gains no inherent ability to write files, execute code, or alter PLC logic through this CVE alone.

Impact Assessment

Confidentiality: Primary impact. The vulnerability is an information-disclosure primitive; the data returned is attacker-selected only insofar as the attacker controls the trigger, not the specific bytes leaked. Over repeated attempts an adversary may aggregate multiple disclosures into a meaningful memory-content picture.

Integrity: No integrity impact is described. The flaw does not permit modification of files, device configuration, or PLC logic.

Availability: No availability impact is described. An out-of-bounds read of this class may terminate the process in some implementations, but the NVD text frames the outcome as disclosure, not denial of service, and no crash behavior is claimed.

Affected systems and blast radius: Installations of Delta ISPSoft on engineering workstations. Because ISPSoft hosts typically reside inside OT/ICS environments with limited segmentation, a compromise of the workstation can serve as a pivot point toward PLC/HMI management planes. The strategic risk is therefore asymmetric: the raw disclosure is moderate, but the location of the affected host — trust-rich, poorly instrumented, often shared — raises the operational stakes.

Severity posture: No NVD CVSS score or vector is published (CVSS: N/A), so no authoritative numeric rating exists. EPSS is not yet scored by FIRST.org, so there is no probabilistic exploitation-likelihood figure. CISA KEV: NO — no known exploited-in-the-wild status. These absences should not be read as evidence of low risk; they reflect a reporting gap.

Detection Guidance

The following rules are written at the vulnerability-class level (out-of-bounds read / anomalous input handling in ISPSoft). They use no invented endpoint, function, or file names. Operators must tune process names, paths, and network ports to their own deployments.

Sigma Rule

title: Potential Delta ISPSoft Out-of-Bounds Read Exploitation Attempt
id: 6c1f9a52-0d3e-4a77-9b21-1f7c2e4d8a10
status: experimental
description: Detects process activity consistent with malformed-input handling in Delta ISPSoft that may indicate exploitation of an out-of-bounds read (CWE-125). Tune binary and path values to the local installation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105227
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.125
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ISPSoft.exe'
      - '\ISPSoft_W.exe'
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\winrar.exe'
      - '\7zFM.exe'
      - '\AcroRd32.exe'
  condition: selection_img and selection_parent
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate opening of project archives received from known partners (tune with allowlists)
level: medium

YARA Rule

rule CVE_2026_105227_ISPSoft_OOB_Read_Hunt
{
    meta:
        description = "Heuristic hunt for crafted Delta ISPSoft project/config files that contain oversized length or offset fields consistent with out-of-bounds read triggering (CWE-125). Class-level heuristic, not a signature."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105227"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $isp_magic = { 49 53 50 00 }        // "ISP\0" - adjust to observed format
        $zip_magic = { 50 4B 03 04 }        // PKZip container common for project bundles

    condition:
        filesize < 200MB and
        (uint32(0) == 0x0A504953 or $isp_magic at 0 or $zip_magic at 0)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-105227 Possible Delta ISPSoft Out-of-Bounds Read Attempt"; flow:to_server,established; content:"ISPSoft"; nocase; offset:0; depth:64; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-105227; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105227; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:9001052; rev:1;)

Elastic Detection

sequence by host.id, process.entity_id with maxspan=2m
  [ process where event.type == "start" and
      process.parent.name in ("winword.exe","excel.exe","outlook.exe","winrar.exe","7zfm.exe","acrord32.exe") ]
  [ process where event.type == "start" and
      process.name : ("ISPSoft.exe","ISPSoft_W.exe") and
      process.args_count >= 0 ]

Splunk SPL Query

index=endpoint OR index=sysmon (EventCode=1 OR event.code=1)
    (Image="*\\ISPSoft.exe" OR Image="*\\ISPSoft_W.exe")
    (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\outlook.exe"
     OR ParentImage="*\\winrar.exe" OR ParentImage="*\\7zFM.exe" OR ParentImage="*\\AcroRd32.exe")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as cmd values(User) as user
        by ComputerName, Image, ParentImage
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="windows,delta_ispsoft,cve_2026_105227,">
  <rule id="100552" level="8">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">ISPSoft(\.exe|_W\.exe)$</field>
    <field name="win.eventdata.parentImage">(winword|excel|outlook|winrar|7zFM|AcroRd32)\.exe$</field>
    <description>Delta ISPSoft launched from a document or archive handler - possible CVE-2026-105227 exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_125,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, advisory, affected-version matrix, or OSV record is available through any tracked source as of this writing. Do not assume any released ISPSoft build is fixed for CVE-2026-105227.

1) Immediate mitigations

• Apply network segmentation between engineering workstations and the corporate IT network; restrict workstation egress to required OT services only.
• Block inbound file types to ISPSoft workstations from untrusted sources at mail and web gateways; strip active project/config attachments from external senders.
• Restrict physical and logical use of removable media on engineering workstations.
• Do not open ISPSoft project or configuration files of unknown provenance; treat such files as untrusted input.
• Enforce least privilege on ISPSoft workstations; avoid administrator rights for day-to-day engineering use.
• Monitor for ISPSoft process launches parented by document viewers or archive tools (see Detection Guidance).

2) Patch / upgrade steps (when available)

• Monitor Delta Electronics' security advisory channel and ICS-CERT/CISA ICS advisories for a fix referencing CVE-2026-105227.
• Maintain a hardware/software inventory of every ISPSoft installation and build number so a fix can be applied rapidly once identified.
• Until a fix exists, treat these systems as unpatched and rely solely on compensating controls listed above.

3) Long-term hardening

• Isolate engineering workstations in a dedicated OT zone with strict firewall policy between zones and no direct internet access from the ISPSoft host.
• Establish a change-control workflow so project files move only through vetted, logged channels.
• Deploy endpoint detection tuned to OT tooling process trees, and forward those logs to a monitored SIEM.
• Add the affected toolset to vulnerability management scope and re-check for an advisory on a recurring basis.

References

• NVD — CVE-2026-105227: https://nvd.nist.gov/vuln/detail/CVE-2026-105227
• MITRE CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-105227 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Delta Electronics security advisory channel: https://www.deltaww.com/en-US/security (check for a CVE-2026-105227 advisory)
• FIRST.org EPSS (no score published for CVE-2026-105227): https://www.first.org/epss/

Threat actor and exploit-in-the-wild status: No exploit code, proof-of-concept, Nuclei template, or KEV listing is associated with CVE-2026-105227 at this time. No named threat actor campaign or observed exploitation has been reported.