# LS Electric GMWin 4 buffer overflow vulnerabilities disclosed

Published: 2025-06-17 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/29d8e907-eec6-55af-bd65-90694a82b641/ls-electric-gmwin-4-buffer-overflow-vulnerabilities-disclosed

> Three memory corruption flaws in discontinued LS Electric GMWin 4 allow code execution or information disclosure via malicious PRJ files.

CISA has disclosed three memory corruption vulnerabilities in LS Electric GMWin 4, a programming software tool for industrial control systems. All three flaws—heap-based buffer overflow (CVE-2025-49850), out-of-bounds read (CVE-2025-49849), and out-of-bounds write (CVE-2025-49848)—exist in PRJ file parsing and stem from insufficient validation of user-supplied data. Each carries a CVSS v4 score of 8.4, with low attack complexity and local attack surface. Successful exploitation allows an attacker with local access to disclose sensitive information or execute arbitrary code. The product is no longer supported; LS Electric discontinued GMWin 4 and recommends users migrate to the XGT series. No public exploitation has been reported to CISA, and the vulnerabilities are not remotely exploitable.

## Mentioned in this report

- Vulnerabilities: CVE-2025-49848, CVE-2025-49849, CVE-2025-49850

## Detection guidance (public sample)

### LS Electric GMWin Spawning Shell or Scripting/WMI Child Process

ATT&CK: T1204.002

GMWin programming software spawning a command shell, scripting host, wmic or LOLBin child process, which may indicate code execution after a malicious PRJ project file triggered a parsing memory-corruption flaw (CVE-2025-49848/49849/49850). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LS Electric GMWin Spawning Shell or Scripting/WMI Child Process
id: 5c1f2726-5b3c-5a77-bbfb-4814a55dc8d1
status: experimental
description: Detects the GMWin engineering software spawning a command shell, scripting
  host, wmic or common LOLBin child process. GMWin only parses PRJ project files and
  has no legitimate need to launch these, so a child process suggests code execution
  through a malicious PRJ file (heap overflow or out-of-bounds read/write in PRJ parsing).
  Generalises on the parent/child relation, not on any specific file name.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-02
tags:
- attack.execution
- attack.t1204.002
- attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \GMWin
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \wmic.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Engineers using a GMWin built-in feature or plugin that shells out to cmd.exe for
  build or export tasks
- Software installers or updaters launched from within the GMWin process tree
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/29d8e907-eec6-55af-bd65-90694a82b641/ls-electric-gmwin-4-buffer-overflow-vulnerabilities-disclosed.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup