Schneider Electric IGSS Definition Out-of-Bounds Write in Malicious CGF File Import Risks Arbitrary Code Execution

Last refreshed2026-10-07

Status: UPDATED | Advisory ID: CVE-2026-12927

Key Details

CVE	CVE-2026-12927
CVSS Score / Version	8.4 (High) / CVSS v4.0
Updated	2026-07-30
Affected products	Schneider Electric IGSS Definition (Def.exe)
Classified as	CWE-787 (Out-of-bounds Write)
Exploitation prediction (EPSS)	0.18% probability of exploitation in the next 30 days (7% percentile) -- FIRST.org's EPSS model.

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Schneider Electric	IGSS Definition (Def.exe)

Vendor

Product

Affected Versions

Patch Status

Schneider Electric

IGSS Definition (Def.exe)

Subsystems	General OT
Sectors	Multiple

What to Know

CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is imported to IGSS Definition.

What to Do

Monitor Schneider Electric's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-12927
CVE	https://www.cve.org/CVERecord?id=CVE-2026-12927

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-12927

CVE