CVE-2021-38406 Delta Electronics DOPSoft 2 Improper Input Validation

Exploited in the wild High 7.8 Published 17 Sep 2021 Updated 21 Oct 2025

An attacker can execute arbitrary code by tricking a user into opening a malicious project file in Delta Electronics DOPSoft 2.

Exploited in the wild: Since 25 Aug 2022
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-38406?

CVE-2021-38406 is a high-severity memory corruption vulnerability in Delta Electronics DOPSoft 2, published on 17 Sep 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

Weakness: CWE-787

Which versions are affected by CVE-2021-38406?

It affects 1 product.

Products include Deltaww Dopsoft.

How do I fix CVE-2021-38406?

No fix has been published for CVE-2021-38406 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Sep 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-38406 being exploited?

Yes. Attackers have exploited CVE-2021-38406 in the wild since at least 25 Aug 2022.

Sources

Also known as GHSA-j3xh-c39x-qghw.