Out-of-bounds read in Horner Automation Cscape
Priority LOW 38CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed Cscape (Horner Automation): 10.2 SP3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Horner Automation | Cscape | before 10.2 SP3 | 10.2 SP3 | Patch available | CNA |
- Cscape VendorHorner Automation Affected before 10.2 SP3 Fixed in 10.2 SP3 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:* | — | — | Horner Automation |
- cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:* Versions — — ·Horner Automation
Remediation
- Fix · CNA Cscape (Horner Automation) Fixed in 10.2 SP3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12897
- 2026-10-03 Alias added: GHSA-xm98-9qfh-q6g4
References
More Horner Automation vulnerabilities
- TI-2022-02442 Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on… CVSS 3.1CRITICAL 9.8
- TI-2026-05510 Horner Automation Cscape and XL4, XL7 PLC Weak password requirements CVSS 4.0CRITICAL 9.3
- TI-2022-02443 Horner Automation’s RCC 972 firmware version 15.40 contains global variables. CVSS 3.1HIGH 7.5
- TI-2025-03638 Out-of-bounds Read in Horner Automation Cscape CVSS 4.0HIGH 8.4
- TI-2024-11326 Horner Automation Cscape Out-of-bounds Read CVSS 4.0HIGH 8.5
- TI-2024-08825 Horner Automation Cscape Out-of-bounds Read CVSS 4.0HIGH 8.5
Sources
- CVE-2026-12897 · CVE Program
- CVE-2026-12897 · NVD
- FIRST EPSS
- GHSA-xm98-9qfh-q6g4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences