noindex and left out of the sitemap until more data is confirmed.CVE-2026-3094 is an out-of-bounds write in the DOPSoft component of Delta Electronics' CNCSoft-G2 engineering software: opening a maliciously crafted DPAX project file lets an attacker execute code in the context of the application, but NVD has not yet published its own Primary CVSS score and neither CISA nor Delta has observed any public exploitation, so this page stays noindex pending that analysis.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-03-04
Published
Vulnerability ID: CVE-2026-3094 · Source: Delta Electronics PSIRT / CISA ICS-CERT (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Delta Electronics CNCSoft-G2 (DOPSoft component) | cpe:2.3:a:deltaww:cncsoft-g2:*:*:*:*:*:*:*:* | All versions before V2.1.0.39 (fixed in V2.1.0.39) |
What this means
CVE-2026-3094 affects Delta Electronics CNCSoft-G2, programming/configuration software for Delta's motion-control and CNC hardware used in manufacturing environments. NVD's description states: "Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process" (NVD).
NVD's vulnerability status is "Analyzed" as of 2026-10-30, but the only CVSS metric on record is a Secondary submission (from the reporting CNA, consistent with Delta's own PSIRT advisory): CVSS v3.1 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — local attack vector, requiring the victim to open a crafted file, with high impact across confidentiality, integrity and availability (NVD). No NVD Primary CVSS metric has been published for this CVE, so per our indexing policy that score is labelled not NVD-confirmed and cvss_score is left null here.
CISA republished the issue as ICSA-26-064-01 on 2026-03-05, confirming CNCSoft-G2 versions before V2.1.0.39 are affected by an out-of-bounds write (CWE-787) while parsing DPAX files in the DOPSoft component, recommending an upgrade to V2.1.0.39, and stating explicitly: "No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time," and that "this vulnerability is not exploitable remotely" because it requires the victim to open a local file (CISA ICS Advisory ICSA-26-064-01). Delta's own PSIRT advisory (Delta-PCSA-2026-00004) covers the same file-parsing out-of-bounds write and fixed version (Delta Electronics PCSA-2026-00004).
CVE-2026-3094 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30, and FIRST scores the probability of exploitation at a low 0.00401 (34.351th percentile), consistent with a local, user-interaction-dependent bug with no reported in-the-wild use (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum bar for indexing and will be revisited once an NVD Primary score is published. In the meantime, CNCSoft-G2 users should upgrade to V2.1.0.39 or later and avoid opening DPAX project files received from untrusted sources.
Evidence
- CNCSoft-G2 fails to validate user-supplied DPAX project files; opening a malicious file lets an attacker execute code in the context of the current process (out-of-bounds write, CWE-787). — NVD
- NVD status is Analyzed as of 2026-10-30; only a Secondary CVSS v3.1 7.8 (HIGH, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is published — no NVD Primary metric exists. — NVD
- CISA advisory ICSA-26-064-01 confirms versions before V2.1.0.39 affected, fix is V2.1.0.39, states no known public exploitation reported and the flaw is not remotely exploitable. — CISA ICS Advisory ICSA-26-064-01
- Delta Electronics' own PSIRT advisory PCSA-2026-00004 documents the same file-parsing out-of-bounds write and fixed version. — Delta Electronics PCSA-2026-00004
- Not listed in the CISA KEV catalog as of 2026-10-30; EPSS score is 0.00401 (34.351th percentile). — FIRST EPSS
