LS Electric GMWin 4 buffer overflow vulnerabilities disclosed
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three memory corruption flaws in discontinued LS Electric GMWin 4 allow code execution or information disclosure via malicious PRJ files.
CISA has disclosed three memory corruption vulnerabilities in LS Electric GMWin 4, a programming software tool for industrial control systems. All three flaws—heap-based buffer overflow (CVE-2025-49850), out-of-bounds read (CVE-2025-49849), and out-of-bounds write (CVE-2025-49848)—exist in PRJ file parsing and stem from insufficient validation of user-supplied data. Each carries a CVSS v4 score of 8.4, with low attack complexity and local attack surface. Successful exploitation allows an attacker with local access to disclose sensitive information or execute arbitrary code. The product is no longer supported; LS Electric discontinued GMWin 4 and recommends users migrate to the XGT series. No public exploitation has been reported to CISA, and the vulnerabilities are not remotely exploitable.
Mentioned in this report
Detection guidance
LS Electric GMWin Spawning Shell or Scripting/WMI Child Process
GMWin programming software spawning a command shell, scripting host, wmic or LOLBin child process, which may indicate code execution after a malicious PRJ project file triggered a parsing memory-corruption flaw (CVE-2025-49848/49849/49850). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LS Electric GMWin Spawning Shell or Scripting/WMI Child Process
id: 5c1f2726-5b3c-5a77-bbfb-4814a55dc8d1
status: experimental
description: Detects the GMWin engineering software spawning a command shell, scripting
host, wmic or common LOLBin child process. GMWin only parses PRJ project files and
has no legitimate need to launch these, so a child process suggests code execution
through a malicious PRJ file (heap overflow or out-of-bounds read/write in PRJ parsing).
Generalises on the parent/child relation, not on any specific file name.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-02
tags:
- attack.execution
- attack.t1204.002
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: \GMWin
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \wmic.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Engineers using a GMWin built-in feature or plugin that shells out to cmd.exe for
build or export tasks
- Software installers or updaters launched from within the GMWin process tree
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs