CVE-2023-34271 is a high severity (CVSS 7.8) out-of-bounds write flaw in how Fatek Automation FvDesigner 1.6.24 parses FPJ project files. A crafted file can run code when someone opens it. ZDI published advisory ZDI-23-769 without a vendor patch, so restrict which files are opened.
What's affected
- Fatek Automation FvDesigner 1.6.24, per the NVD record and ZDI-23-769.
- No fixed version is listed in the ZDI advisory or the NVD record. ZDI published it as a zero-day advisory after the vendor did not provide a patch in time.
- A user must open a malicious file or visit a malicious page, so user interaction is required.
The weakness is CWE-787: writing outside the bounds of an allocated buffer, which can corrupt memory the program depends on. ZDI tracked the report as ZDI-CAN-18178.
How to check if you're exposed
FvDesigner is a Windows engineering application, so there is no package manager check. Instead:
- Inventory the engineering workstations that have Fatek FvDesigner installed, and record the version from the application's About screen or the installed programs list.
- Confirm which machines hold version 1.6.24, the version named in the record.
- Ask engineers where FPJ project files come from, such as integrators, vendors, email, or shared drives.
Check the Fatek support site for any later release and its notes, since no fix is documented in the sources we read.
What to do now
- Check with Fatek for an updated FvDesigner release and read its release notes before relying on any claim of a fix.
- Treat FPJ files from outside your team as untrusted. Open them only after confirming the source by a second channel.
- Keep FvDesigner on engineering workstations that are separate from email and web browsing, and without administrator rights for the daily account.
- Store trusted project files in a controlled repository with change tracking, so a swapped file is noticed.
- Back up controller programs and project files regularly so you can rebuild if a workstation is compromised.
If you track software dependencies, the free in-browser dependency scan can show which of your components carry known CVEs, and the Gold directory lists the same records in one place.
Why it matters
The advisory says the parser does not properly validate user-supplied data, so a write can land past the end of an allocated data structure. Parsing code for file formats is a frequent source of memory safety bugs because the file is fully controlled by whoever made it. ZDI scored the flaw 7.8 with a local attack vector and required user interaction, and says an attacker who succeeds runs code in the context of the current process.
This is one of a batch of FPJ parsing flaws that ZDI published together on 31 May 2023. Each has its own CVE, but the practical defense is the same: limit who can hand you project files and which accounts open them. ZDI states that, given the nature of the issue, the only salient mitigation is to restrict interaction with the application.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a patch?
None is listed in the ZDI advisory or the record. ZDI reported the issue to the vendor in August 2022 and published in May 2023. Check Fatek directly for newer releases.
What is the best mitigation?
ZDI advises restricting interaction with the application. In practice, avoid opening FPJ files from untrusted sources.
Sources
Last reviewed: 19 October 2026.
