CVE-2011-10015: Cytel Inc Cytel Studio

Critical severity, CVSS 9.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.

Affected products

• Cytel Inc Cytel Studio: up to and including 9.0

Published 2025-08-13. Last modified 2026-06-16.