Schneider Electric ProClima up to 6.1 F1 Bookview buffer overflow

This strike exploits a memory corruption vulnerability in Schneider Electric ProClima F1BookView ActiveX Control. Specifically the vulnerability in how the Rule and Text parameters are processed as iteration counters in a loop. The loop reads these 2 parameters and calculates their length. Then this data is read onto the stack and if x or y is larger than the amount of data between the current memory location and the end of the stack, a memory access violation occurs.