cve-2025-7228

The tag cve-2025-7228 covers a coordinated vulnerability disclosure involving multiple high-severity remote code execution (RCE) flaws in INVT VT-Designer and HMITool, two engineering and HMI utilities used in industrial and building automation. These vulnerabilities, assigned under a cluster of CVE identifiers, stem from file-parsing logic that can be exploited when a user opens a crafted project or VPM file, leading to out-of-bounds writes and type-confusion conditions. Successful exploitation may allow arbitrary code execution in the context of the application process. The impact is significant because these tools are commonly deployed on Windows engineering stations and operator workstations in industrial control system (ICS) environments.