CVE-2026-12921
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
Risk Assessment
The risk for the organization is the potential for remote code execution by an attacker, which could lead to system compromise, data theft, or disruption of industrial processes.
Recommendation
It is recommended to immediately update AzeoTech DAQFactory to the latest available version that fixes this vulnerability and avoid opening untrusted .ctl files.
Other vulnerabilities in AzeoTech DAQFactory
See all- CVE-2017-12699High
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones.
- CVE-2025-66589Critical
In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system crash.
- CVE-2026-12390High
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
Original NVD description (English source)
In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.