CVE-2025-4125 is a high severity out-of-bounds write (CVSS 7.8) in Delta Electronics ISPSoft 3.20. Parsing a crafted ISP project file could let an attacker run code on the engineering workstation. Delta says v3.21 or later corrects it, so update and avoid untrusted files.
What's affected
Delta advisory PCSA-2025-00004 lists ISPSoft v3.20 and prior as affected. The advisory was published on 16 April 2025 and updated on 30 April 2025, and it marks the issue as corrected.
The remediation is to download v3.21 or later from the Delta download center. Delta lists no workaround, which means updating is the main fix.
The advisory groups several CVEs for ISPSoft. CVE-2025-4125 and CVE-2025-4124 are out-of-bounds writes under CWE-787, and three other entries cover stack-based buffer overflows. All sit under the same fixed version.
How to check if you're exposed
ISPSoft is programming software for Delta controllers, so look at engineering laptops and any shared project servers. In the application, open the About dialog to read the version. If it shows 3.20 or earlier, it is in range.
Also ask where ISP files come from. The CVSS vector requires local access and user interaction, which in practice means someone must open a file. Check email attachments, shared drives and vendor handoffs that bring project files onto those machines.
Your software inventory tool, if it covers engineering workstations, can list the installed version across the fleet.
What to do now
- Find every installation of ISPSoft and note the version.
- Update to v3.21 or later from the Delta download center.
- Only open ISP files from sources you trust, and scan files that arrive from outside before opening.
- Keep engineering workstations off the open internet and separate from the business network, as the Delta recommendations say.
- Use a VPN when remote access to control systems is required.
Why it matters
The record classifies this as CWE-787, out-of-bounds write. The parser trusts something in the file about how much data to store, and then writes past the end of the memory it set aside. That kind of memory error can overwrite nearby data and, in the worst case, let an attacker run code with the rights of the user who opened the file.
The CVE is not on the CISA Known Exploited Vulnerabilities list. The risk here is a targeted one. A project file is a trusted artifact in many plants, passed between engineers and integrators, so a booby trapped file can ride in on a normal workflow.
Try it yourself
When a vendor ships a fixed version, the job is to find where the old one lives. This demo shows how fix availability is surfaced.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-4125?
Delta says to update to ISPSoft v3.21 or later. Versions 3.20 and earlier are affected.
Does an attacker need network access?
The vector is local with user interaction, so the realistic route is getting someone to open a malicious ISP file.
Sources
Last reviewed: 18 October 2026.
