CVE-2026-1361 is a high severity stack based buffer overflow (CVSS 7.8) in Delta Electronics ASDA-Soft V7.2.0.0 and prior. Delta says to upgrade to V7.2.2.0 or later. The attack is local and needs the user to act, so the practical risk is a malicious file or link.
What's affected
Delta lists ASDA-Soft V7.2.0.0 and prior as affected. The fix is ASDA-Soft V7.2.2.0 or later, available from the Delta Download Center. Delta marks the issue as corrected and says there is no workaround. The advisory is Delta-PCSA-2026-00003 and was first published on 27 January 2026.
How to check if you're exposed
Open ASDA-Soft and read the version under the About dialog. Anything at V7.2.0.0 or older is affected. Engineering workstations and laptops used for servo drive configuration are the usual places for this software, so check those and any shared lab machines.
What to do now
- Find all machines with ASDA-Soft installed.
- Download V7.2.2.0 or later from the Delta Download Center and install it.
- Do not open unsolicited project files or follow untrusted links from email on those machines.
- Keep control systems and engineering tools off the internet.
- Record versions in your asset list for future checks.
Why it matters
A stack based buffer overflow writes past a fixed buffer on the call stack. If the program reads a file or input larger than it expects without a length check, the extra data can overwrite control information. That is why the record also lists out-of-bounds write.
The vector is local with user interaction, so an attacker needs a person to open something. Delta repeats general advice in the advisory: do not click untrusted links, and do not expose control systems to the internet. The record does not flag this CVE as known exploited.
The record lists these weakness classes: CWE-121 (Stack-based Buffer Overflow), CWE-787 (Out-of-bounds Write).
Quick check
Is this reachable from the internet?
The vector is local with user interaction. The risk comes from someone opening crafted content on the workstation.
Sources
Last reviewed: 19 October 2026.
