CVE-2025-22884 is a high severity (CVSS 7.8) stack-based buffer overflow in Delta Electronics ISPSoft 3.20. A crafted DVP file can lead to arbitrary code execution when the software parses it. Delta's advisory says to update to ISPSoft v3.21 or later and lists no workaround.
What's affected
Delta Electronics advisory Delta-PCSA-2025-00004 covers ISPSoft version 3.20 and prior. It was published on 16 April 2025 and last updated on 30 April 2025. It lists the mitigation as downloading and updating to ISPSoft v3.21 or later, and says there is no workaround.
The advisory groups several CVEs by weakness type: stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787). The CVSS vector for this CVE is AV:L/AC:L/PR:N/UI:R, so the attacker needs the victim to open a malicious file locally. It is not a network service flaw.
How to check if you're exposed
Open ISPSoft and check the version in the About dialog, or look at the installed programs list on the engineering workstation. Version 3.20 and earlier are affected.
Then find where project files come from. Engineering laptops often receive files from integrators, vendors and email. Those are the files that need caution until the update is in place.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Download ISPSoft v3.21 or later from the Delta download center.
- Install the update on every engineering workstation that has ISPSoft.
- Until then, open project files only from trusted sources and avoid unsolicited attachments, as Delta advises.
- Keep control systems off the internet and behind a firewall, separated from the business network, as the advisory recommends.
- Use a VPN for remote access to engineering networks.
Why it matters
CWE-121 is a stack-based buffer overflow. The program copies file data into a fixed size buffer on the stack without checking length, so data from the file overwrites neighboring memory. Stack overflows often corrupt control data, which is why advisories describe the result as possible arbitrary code execution.
Three Delta CVEs in the same advisory describe parsing flaws in ISPSoft, and one more is the same class in another file type. The shared fix is the same release, v3.21, so patching once covers the group the advisory lists. The KEV flag is false and neither record nor advisory claims exploitation.
Quick check
Is one update enough for all the ISPSoft CVEs in the advisory?
The advisory lists v3.21 or later as the mitigation for the whole advisory, which covers all the CVEs it names.
What is the main risk?
Opening an untrusted project file on an engineering workstation, which could run attacker code.
Sources
Last reviewed: 19 October 2026.
