CISA ICSA-26-188-06: Labcenter Proteus 9 Out-of-Bounds Write, Stack Overflow, UAF Vulnerabilities

Vulnerability Overview Vulnerability Name: Labcenter Proteus 9 Publication Date: July 7, 2026 Alert Code: ICSA-26-188-06 Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: Proteus 9.1_SP4_Build_42914 CVSS Score: v3.7.8 Vendor: Labcenter Electronics Device: Labcenter Proteus 9 Vulnerability Types: - Out-of-bounds Write - Stack Buffer Overflow - Use-after-free Remediation Recommended Practices: - Minimize network exposure by ensuring that all control system devices and/or systems are not directly accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - Use more secure remote access methods, such as Virtual Private Networks (VPNs), and ensure that VPNs are updated to the latest version. - Conduct appropriate impact analysis and risk assessment to deploy defensive measures. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and report to CISA. - Do not click on web links or open unsolicited email attachments. - Refer to resources on avoiding email fraud and social engineering attacks. Vulnerability Details CVE-2026-42953 CVE-2026-49033 CVE-2026-42958 Background Critical Infrastructure Sectors: Communications, Critical Manufacturing, Defense Industrial Base, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems Deploying Countries/Regions: Global Company Headquarters Location: United Kingdom Acknowledgments Michael Heinzl reported these vulnerabilities to CISA. Revision History Initial Publication Date: 2026-07-07 Tags Sectors: Communications Sector, Critical Manufacturing Sector, Defense Industrial Base Sector, Energy Sector, Healthcare and Public Health Sector, Transportation Systems Sector, Water and Wastewater Systems Sector Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Links Related Announcements: - Hitachi Energy e-mesh EMS - Hitachi Energy PROMOD V - Hydro-Québec Le Circuit Electrique charging station backend - Digi International PortServer TS, Digi One SP IA Legal Notice and Terms of Use This product is subject to this notice and the Privacy and Usage Policy. Feedback Please share your thoughts; we have recently updated our anonymous product survey and welcome your feedback. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security Summary This page summarizes multiple vulnerabilities in Labcenter Proteus 9, including out-of-bounds write, stack buffer overflow, and use-after-free. The affected version is Proteus 9.1_SP4_Build_42914, with a CVSS score of v3.7.8. CISA provides detailed remediation advice and recommended practices to minimize the risk of these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-188-06: Labcenter Proteus 9 Out-of-Bounds Write, Stack Overflow, UAF Vulnerabilities

More from this source