CVE-2021-38406: Delta DOPSoft 2 project file parsing out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is in CISA's Known Exploited Vulnerabilities catalog, has a very high EPSS score, enables code execution, and affects an end-of-life product with no clear patch path.

What it is

Delta Electronics DOPSoft 2 (version 2.00.07 and prior) does not properly validate user-supplied data when parsing specific project files, leading to multiple out-of-bounds write instances. Because the flaw allows code execution in the context of the current process, opening a crafted project file can compromise the engineering workstation running the software.

Impact

An attacker can corrupt memory and execute arbitrary code with the privileges of the DOPSoft process, potentially allowing full control of the workstation used to program Delta HMI/PLC equipment.

Attack surface

The vulnerability is reached locally by opening a malicious project file, requiring user interaction (CVSS vector AV:L/UI:R) and no prior authentication. The record does not describe any network-reachable path.

Exploitation

CVE-2021-38406 is listed in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates a 30-day exploitation probability of about 76% (99.5th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the vendor fix if available; note CISA states the impacted product is end-of-life, so treat patching as unlikely and plan replacement.
• Disconnect or isolate end-of-life DOPSoft 2 installations from networks if they must remain in use.
• Restrict project file handling to trusted sources and scan incoming project files before opening them.
• Run DOPSoft in a hardened, non-privileged environment or sandbox to limit the impact of code execution.
• Monitor CISA's advisory and KEV entry for updated guidance.

Detection

• Monitor for DOPSoft 2 process crashes or abnormal child processes spawned from the application.
• Alert on DOPSoft opening project files from email downloads, removable media, or untrusted network shares.
• Track execution of DOPSoft 2 on engineering workstations and flag installations still running version 2.00.07 or earlier.
• Review endpoint telemetry for memory corruption indicators or unexpected code execution in the DOPSoft process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.