CVE-2026-105228

Executive Summary

CVE-2026-105228 is an out-of-bounds read (CWE-125) vulnerability affecting installations of Delta ISPSoft, an industrial automation programming and configuration suite used to develop, compile, and download logic for Delta programmable logic controllers (PLCs) and related automation hardware. The NVD description states the flaw "allows remote attackers to disclose sensitive information" on affected installations, implying a network-reachable attack surface and a confidentiality-only impact class. No CVSS score, vector, affected version range, vendor advisory, patch reference, public proof-of-concept, or exploit code is available from any tracked source; the CVE is unpatched as of this report.

Technical Analysis

The vulnerability is classified as CWE-125: Out-of-bounds Read. This weakness class occurs when software reads data past the end (or before the beginning) of an allocated buffer, array, or structure without validating the index or length boundary. In memory-unsafe languages (C and C++, which are typical for engineering workstation software that interacts with native hardware drivers and proprietary file formats), this class routinely manifests when parsing untrusted input: length fields, record counts, offsets, or type tags embedded in a file or protocol message are trusted and used to index into a buffer whose actual size is smaller than the value provided.

The NVD description explicitly characterizes the impact as information disclosure, not remote code execution. In the out-of-bounds read class, the practical consequence of reading beyond a buffer boundary is that adjacent in-process memory — heap metadata, adjacent object fields, pointers, string data, cryptographic key material held in memory, configuration values, or session tokens — may be returned to the attacker or included in a response, error message, or log. Where the read overflows into unmapped memory, the more common outcome is an access violation that terminates the process (denial of service); the description's emphasis on disclosure therefore implies the reads occur within mapped regions and the disclosed bytes reach an attacker-controlled channel.

No function names, class names, file paths, endpoints, protocol fields, or parameter names are provided in the NVD description or CNA title. This report therefore describes the vulnerability strictly at the class and mechanism level. Any specific parser, handler, or interface referenced below would require the vendor advisory or a public root-cause analysis to confirm, neither of which exists at this time.

Attack surface considerations that follow logically from the description ("remote attackers," "affected installations of Delta ISPSoft"): the attack is network-reachable, which means the vulnerable parsing path is exposed through a network-facing service or through the ingestion of remotely supplied data. Industrial engineering software of this type commonly parses project files (.isp-style proprietary formats in the Delta toolchain), controller firmware images, device descriptor files, and network traffic to/from PLCs, and may also run background services that listen for controller communications or licensing/host traffic. Without vendor confirmation, the precise reachable path cannot be narrowed further; analysts should treat the full set of untrusted input ingestion paths in ISPSoft as candidate vectors.

Two independent failure modes typically underpin exploitation of this class:

1. Insufficient bounds checking on attacker-supplied length or count values prior to a read.
2. A signedness or integer-truncation error where a computed index or size wraps and is subsequently used as a read bound.

Either failure permits a read to walk past the intended buffer. Because confidentiality impact is asserted while integrity and availability impacts are unstated, the most likely CVSS Impact subscore profile is High Confidentiality with None/Low Integrity and None/Low Availability, but no CVSS vector is published and none should be assumed.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-105228, and no exploit code or Nuclei template is available. The attack chain below is inferred from the out-of-bounds read class and the NVD description's statement that remote attackers can disclose sensitive information on affected installations. No specific functions, endpoints, or file formats are asserted because none are provided in the source data.

1. Reconnaissance and target identification. An attacker locates internet- or network-exposed Delta ISPSoft installations. Exposed engineering workstations are typically identified through banner grabbing, service fingerprinting, or internet scanning against the known service associated with the product. Because the flaw is described as remotely exploitable, the target is a listening service or a data-ingestion path rather than a purely local condition. Where the exposure is indirect (for example a workstation that consumes attacker-controllable files or controller responses), reconnaissance instead targets the mechanism by which those inputs are delivered.

2. Triggering the out-of-bounds read. The attacker supplies a crafted input to the vulnerable read path. At the vulnerability-class level, this input manipulates a length, count, offset, or index value such that the program reads beyond the bounds of an allocated buffer. Because the description does not identify the interface, the attacker's delivery method is either (a) direct transmission of a malformed request/message to the vulnerable service, or (b) provision of a malformed data artifact (project file, controller payload, or response) that ISPSoft then parses. In both cases the pre-condition is that the value governing the read is trusted without adequate bounds validation.

3. Payload and execution method. Unlike a write primitive, an out-of-bounds read is not executed as a control-flow hijack. The attacker's "payload" is the crafted length/offset/index value plus the surrounding well-formed structure needed to reach the vulnerable read. The read itself then causes bytes from beyond the buffer boundary to be consumed by the vulnerable routine and—critically—surfaced back to the attacker through whatever output channel the request produces (a response packet, UI display, error/log message, or exported data). The disclosure effect is achieved by the difference between what should have been read and what was actually returned.

4. Post-exploitation impact. Successful exploitation yields memory contents. Depending on what resides adjacent to the over-read buffer, the attacker may recover configuration data, credentials or tokens used by the tool to authenticate to controllers, memory layouts and pointers useful for defeating ASLR in a subsequent exploitation stage, and project/intellectual-property data. Because ISPSoft is engineering software, disclosed material may include controller credentials and process configuration, enabling lateral movement from the engineering workstation to the OT/PLC layer. The confidentiality impact is the primary stated effect; if the malformed input also causes an in-mapped/unmapped boundary fault, availability impact (process crash) may accompany it.

Practical caveat: until a vendor advisory or a public analysis exists, the exact trigger surface remains unconfirmed. Defensive planning should assume any remotely reachable parsing path in ISPSoft is in scope.

Impact Assessment

The blast radius is bounded by the fact that ISPSoft is an engineering workstation / configuration application rather than a broadly deployed server product. Affected systems are the installations running the vulnerable ISPSoft build, plus any OT assets those workstations manage or authenticate to.

• Confidentiality (likely High, unconfirmed): The NVD description centers entirely on disclosure of sensitive information. Engineering workstations are high-value because they hold controller credentials, network topology, project source, and often indirect reachability into production automation networks.
• Integrity (unrated): An out-of-bounds read has no inherent write primitive, so direct modification of data is not expected from this flaw alone; disclosed secrets could be leveraged in a follow-on attack that does modify data.
• Availability (unrated): Out-of-bounds reads can fault and crash the process when the read crosses an unmapped boundary; a crash of an engineering station could interrupt commissioning or operations, but availability impact is not asserted in the source data.
• CVSS: No score or vector has been published. Any numeric estimate in circulation is not attributable to NVD and should be disregarded.
• EPSS / KEV: Not scored by FIRST.org and not listed in CISA KEV. There is no evidence of exploitation in the wild at the time of writing.

Because the vulnerability class frequently yields information useful to attackers (pointers, credentials), severity should not be downgraded solely due to the absence of a public exploit. An unpatched information disclosure in OT engineering software is a meaningful precursor risk even without a weaponized PoC.

Detection Guidance

Sigma Rule

title: Potential Delta ISPSoft Out-of-Bounds Read Exploitation (CVE-2026-105228)
id: 7f3c2a90-1052-28af-0000-cve2026105228
status: experimental
description: Detects anomalous process behavior consistent with a remotely triggered out-of-bounds read in Delta ISPSoft, such as process crashes/exits while handling network or file input.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105228
author: valtersit.com
date: 2026/01/01
logsource:
  product: windows
  service: application
detection:
  selection_image:
    Image|endswith:
      - '\ISPSoft.exe'
      - '\ISPSoftService.exe'
  selection_error:
    EventID:
      - 1000   # Application Error
      - 1001   # Windows Error Reporting
    Message|contains:
      - 'ISPSoft'
  selection_access_violation:
    Message|contains:
      - '0xc0000005'   # access violation
      - 'Exception code'
  condition: selection_image and (selection_error or selection_access_violation)
falsepositives:
  - Legitimate ISPSoft crashes unrelated to exploitation
level: medium
tags:
  - attack.t1190
  - cve.2026-105228

YARA Rule

rule CVE_2026_105228_Delta_ISPSoft_OOB_Read
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection for malformed input targeting Delta ISPSoft out-of-bounds read (CVE-2026-105228)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105228"
        date = "2026-01-01"
        cve = "CVE-2026-105228"

    strings:
        $ispsoft = "ISPSoft" ascii wide nocase
        $delta  = "Delta" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and
        ( $ispsoft or $delta ) and
        filesize < 100MB
}

Note: This is a heuristic file-identification rule only. No reliable byte-pattern signature can be authored for CVE-2026-105228 because no exploit code, crash sample, or root-cause detail is public. Pair this with behavioral rules for stronger coverage.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-105228 - Possible Delta ISPSoft Out-of-Bounds Read Exploitation (Remote Information Disclosure)"; flow:to_server,established; content:"ISPSoft"; nocase; sid:2026105228; rev:1; reference:cve,2026-105228; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105228; metadata:created_at 2026_01_01, updated_at 2026_01_01; classtype:attempted-recon;)

Note: Because the vulnerable protocol/port is not public, this is a generic placeholder that keys on the product identifier in traffic. Deploy only after confirming the actual service port for your environment.

Elastic Detection

sequence by process.entity_id
  [process where process.name in ("ISPSoft.exe", "ISPSoftService.exe") and network where destination.port != 0]
  [process where process.name in ("ISPSoft.exe", "ISPSoftService.exe") and process.Ext.code_signature.status == "TRUSTED" and event.action == "exit" and process.exit_code : 5]

Note: Modeled on EQL using a network activity event followed by a process exit, approximating "network-triggered crash." Adjust process.exit_code to the access-violation code observed in your telemetry (Windows access violations surface elsewhere; validate in your environment).

Splunk SPL Query

index=wineventlog (sourcetype="WinEventLog:Application" OR source="WinEventLog:Application")
  (EventCode=1000 OR EventCode=1001)
  ("ISPSoft" OR "ISPSoft.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by host, EventCode, Message
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="delta,ispsoft,cve-2026-105228,">
  <rule id="100528" level="8">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <match>ISPSoft</match>
    <description>CVE-2026-105228: Possible Delta ISPSoft out-of-bounds read / process crash - potential remote information disclosure.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105228,</group>
  </rule>
</group>

Note: These detections target anomalous/crash behavior consistent with a remotely triggered out-of-bounds read. They are behavioral and cannot confirm exploitation on their own; no reliable byte-level signature is possible without a public PoC or vendor root-cause analysis.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected version range, or workaround is available.

1. Immediate mitigations (do not wait for a patch):

   • Remove ISPSoft engineering workstations from internet exposure. Engineering software should never be directly reachable from untrusted networks.
   • Segment OT engineering workstations from IT and from the production control network; enforce strict firewall rules so that only required controller protocol flows are permitted.
   • Apply the principle of least privilege: run ISPSoft under a dedicated, unprivileged local account and not an administrative credential.
   • Restrict file/project ingestion: only open project, firmware, and descriptor files from trusted, integrity-controlled sources; scan removable media.
   • Monitor the workstations with the detection rules above for anomalous crashes and unexpected disclosure events; alert on any process exit of ISPSoft with access-violation codes.
   • Establish an allow-list of which hosts may communicate with the workstation and which controller devices it may reach.

2. Patch / upgrade steps:

   • No patch is available. Monitor Delta Electronics' official security advisory channel and the NVD entry for CVE-2026-105228 for an affected-version matrix and firmware/software update.
   • When a fix is released, treat it as urgent; because these are OT engineering assets, plan the upgrade in a change-controlled maintenance window and re-validate controller connectivity after updating.
   • Until a fixed build is published, freeze the vulnerable version in place, do not introduce new installations, and increase monitoring accordingly.

3. Long-term hardening:

   • Maintain an accurate inventory of engineering workstations and the software versions installed on them; version-awareness is a prerequisite for reacting to this CVE.
   • Adopt a patch/vulnerability management process that includes OT software, not just IT endpoints.
   • Harden workstations with application allow-listing, host-based firewall rules, and endpoint detection/response agents capable of behavioral monitoring.
   • Network-detect and alarm on engineering workstation traffic deviations (new destinations, unexpected ports, large outbound data).
   • Train engineers to recognize suspicious files, phishing, and social-engineering lures that could deliver a crafted input to the workstation.

References

• NVD — CVE-2026-105228: https://nvd.nist.gov/vuln/detail/CVE-2026-105228
• CWE-125: Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (no score available at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No exploit code, PoC, Nuclei template, EPSS score, or CISA KEV entry is associated with CVE-2026-105228 at the time of writing. No named threat actor campaign has been attributed to this CVE in the source data.