# Delta Electronics DIAScreen buffer overflow in project files

Published: 2025-10-07 · Severity: routine · Sectors: energy
Canonical: https://vorant.io/reports/8f47345e-b6f8-5450-bd96-cd54c9b030e8/delta-electronics-diascreen-buffer-overflow-in-project-files

> Four out-of-bounds write flaws in Delta DIAScreen affect version 1.6.0 and prior; requires user interaction to exploit via malicious project files.

CISA published an advisory on Delta Electronics DIAScreen, a visualization and monitoring software used in energy-critical infrastructure, documenting four distinct out-of-bounds write vulnerabilities (CWE-787). All four flaws share the same attack mechanism: when a valid user opens a maliciously crafted project file, the application writes data outside its allocated memory buffer. This can lead to information disclosure, integrity compromise, and availability impact. The vulnerabilities affect DIAScreen version 1.6.0 and earlier. CVSS v4 scores are 6.8 for each flaw, reflecting low attack complexity and the requirement for user interaction (opening a file). No remote exploitation is possible, and no active exploitation has been reported to CISA at the time of publication. Delta Electronics has released version 1.6.1 as a patch addressing all four vulnerabilities. The advisory recommends immediate patching on all affected systems and reinforces standard social engineering mitigations to prevent users from being tricked into opening malicious files.

## Mentioned in this report

- Vulnerabilities: CVE-2025-59297, CVE-2025-59298, CVE-2025-59299, CVE-2025-59300

## Detection guidance (public sample)

### DIAScreen Spawning Shell or Scripting Child Process

ATT&CK: T1204.002

DIAScreen.exe spawning a command shell, script host or LOLBin, which may indicate exploitation of an out-of-bounds write via a crafted project file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DIAScreen Spawning Shell or Scripting Child Process
description: Detects Delta Electronics DIAScreen spawning command interpreters or
  common living-off-the-land binaries. The visualization software does not normally
  launch these, so a child process after a user opens a project file may indicate
  memory-corruption exploitation (CWE-787) of a crafted file.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \DIAScreen.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Engineers using DIAScreen features or scripts that deliberately invoke cmd.exe for
  automation
- Vendor installer or updater helper processes launched from the application
level: high
id: 71448887-1ebd-55e1-baa6-238f46cc1a2c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-280-01
```

### DIAScreen Launched by Email Client, Browser or Archiver

ATT&CK: T1566.001

DIAScreen started directly from an email client, browser or archive utility, consistent with a user opening a phished project file attachment or download. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DIAScreen Launched by Email Client, Browser or Archiver
description: Detects DIAScreen.exe started by an email client, web browser or archive
  utility. This parent/child relation suggests a user opened a project file received
  as an attachment or download, the delivery path for crafted DIAScreen project files.
  Context needed, since engineers may legitimately open project files this way.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \DIAScreen.exe
    ParentImage|endswith:
    - \OUTLOOK.EXE
    - \thunderbird.exe
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \WinRAR.exe
    - \7zFM.exe
  condition: selection
falsepositives:
- Engineers opening vendor-supplied project files directly from email or a browser
  download
- Integrators receiving legitimate project files from OEM partners
level: medium
id: a9ed9f7b-d51d-5b80-a963-6ed2922d90b6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-280-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-280-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8f47345e-b6f8-5450-bd96-cd54c9b030e8/delta-electronics-diascreen-buffer-overflow-in-project-files.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup