A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.

A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.

In Panasonic Control FPWIN versions 7.6.0.3 and prior, a stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or a parameter to a function). Panasonic Control FPWIN versions 7.6.0.3 and prior allocates or initializes a resource such as a pointer, object, or variable using one type, but later accesses that resource using a type that is incompatible with the original type. Panasonic Control FPWIN performs operations on a memory buffer, but can read from or write to a memory location that is outside of the intended boundary of the buffer.

Control FPWIN Pro7 provided by Panasonic contains multiple vulnerabilities listed below. * Stack-based Buffer Overflow (CWE-121) - CVE-2023-28728 * Access of Resource Using Incompatible Type (CWE-843) - CVE-2023-28729 * Improper Restriction of Operations within the Bounds of a Memory Buffer Michael Heinzl first contacted JPCERT/CC, and JPCERT/CC advised him to contact Panasonic directly. Afterwards, he reported these vulnerabilities to Panasonic and coordinated with them. Panasonic and JPCERT/CC published respective advisories in order to notify users of these vulnerabilities.