CVE-2025-49849: PRJ File Parser Use-After-Free Flaw

CVE-2025-49849 Overview

CVE-2025-49849 is an out-of-bounds read vulnerability triggered during the parsing of PRJ (projection) files. The flaw results from insufficient validation of user-supplied data within the file parsing routine. Processing a crafted PRJ file can produce multiple memory corruption conditions, including reads and writes past the end of allocated buffers. The issue is tracked under CWE-125: Out-of-bounds Read and was published through a CISA Industrial Control Systems advisory.

Exploitation requires a local attack vector with user interaction, typically by convincing a user to open a malicious PRJ file. Successful exploitation impacts confidentiality, integrity, and availability of the affected application.

Critical Impact
A crafted PRJ file can corrupt memory in the parsing application, leading to information disclosure, application crash, or potential code execution within the user's security context.

Affected Products

Applications that parse PRJ projection files (see CISA ICS Advisory ICSA-25-168-02 for the specific vendor and product details)
Specific affected versions are enumerated in the referenced CISA advisory
No CPE entries are currently published in the NVD record

Discovery Timeline

2025-06-17 - CVE-2025-49849 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49849

Vulnerability Analysis

The vulnerability resides in the routine responsible for parsing PRJ files. PRJ files describe coordinate reference systems and are commonly consumed by geospatial and engineering applications. The parser reads structured fields from the file without validating that offsets and lengths remain inside the allocated buffer. A crafted PRJ file can therefore cause the parser to read memory beyond the bounds of the input structure.

The advisory notes that the same root cause can lead to both out-of-bounds reads and writes. This indicates that boundary checks are missing across multiple code paths sharing the same input handling. The result is a class of memory corruption conditions rather than a single isolated bug.

Local access and user interaction are required, which aligns with the typical workflow of opening a project or projection file in a desktop application. No privileges are required on the host beyond the ability to run the target application.

Root Cause

The parser fails to validate user-supplied length and offset fields against the actual size of allocated data structures before dereferencing them. Untrusted values from the PRJ file are used directly as indices or sizes, violating the input validation contract for file-format parsing.

Attack Vector

An attacker crafts a malicious PRJ file containing manipulated structural fields. The file is delivered through email, shared drives, project archives, or other distribution channels. When a user opens the file in the vulnerable application, the parser performs an out-of-bounds memory access. Depending on the affected code path, this can disclose adjacent memory contents, crash the process, or be chained with a write primitive for code execution.

No verified public exploit code is referenced in the available advisory data. See CISA ICS Advisory ICSA-25-168-02 for additional technical detail from the coordinating authority.

Detection Methods for CVE-2025-49849

Indicators of Compromise

Unexpected crashes or hangs in applications immediately after opening a .prj file
PRJ files of anomalous size or containing non-textual data when the format normally contains WKT (Well-Known Text) strings
Crash dumps showing access violations inside the file parsing module of the affected application
PRJ files arriving from external sources outside normal project delivery workflows

Detection Strategies

Inspect endpoint telemetry for application crashes correlated with the opening of .prj files
Build YARA or content rules that flag PRJ files exceeding expected size thresholds or containing binary content where WKT text is expected
Monitor for process-level exceptions such as access violations in workstations used by GIS, surveying, or engineering staff
Correlate file-open events with subsequent abnormal child process creation from the parent application

Monitoring Recommendations

Forward application crash events and Windows Error Reporting telemetry to a central log platform for review
Track inbound .prj files received through email gateways and file-sharing platforms
Alert on execution of unsigned binaries or scripts spawned by the affected application following file open events

How to Mitigate CVE-2025-49849

Immediate Actions Required

Identify endpoints running software that processes PRJ files and inventory installed versions against the advisory
Apply the vendor patch as documented in CISA ICS Advisory ICSA-25-168-02 once available in your environment
Restrict opening of PRJ files received from untrusted or external sources until patching is complete
Brief GIS and engineering teams on the risk of opening unsolicited project files

Patch Information

Refer to CISA ICS Advisory ICSA-25-168-02 for the authoritative list of fixed versions and vendor patch links. The NVD entry for CVE-2025-49849 does not enumerate CPE-bound product versions, so the CISA advisory is the primary remediation reference.

Workarounds

Limit PRJ file ingestion to vetted internal sources and signed project packages
Run the affected application under a standard user account with no administrative privileges to limit post-exploitation impact
Use application allowlisting to prevent the parser process from spawning unexpected child processes such as command shells or scripting hosts
Sandbox or isolate workstations that routinely process third-party geospatial data