cve-2025-7225

The tag cve-2025-7225 covers a coordinated vulnerability disclosure involving multiple high-severity remote code execution (RCE) flaws in INVT VT-Designer and HMITool, which are engineering and HMI utilities used in industrial and building automation. The vulnerabilities stem from file-parsing logic and permit an attacker to trigger out-of-bounds writes and type-confusion conditions by tricking a user into opening a crafted project or VPM file, leading to arbitrary code execution in the context of the application. These tools are commonly run on Windows engineering stations and operator workstations, making the flaws relevant to Windows-based industrial control system environments.