Open Design Alliance vulnerabilities

5 vulnerabilities

Known vulnerabilities in Open Design Alliance products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

5
7CVE-2025-10021open design allianceoda drawings sdk - all versions < 2026.12
EPSS score
0.15%
A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior,  memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.6.9CVE-2024-12564open design alliancecde inweb sdk
EPSS score
0.67%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation.8.1CVE-2024-8894open design allianceoda drawings sdk - all versions < 2025.10
EPSS score
0.19%
Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on received SectionIterator data can trigger an unhandled exception. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution.7.8CVE-2023-5179open design allianceoda drawings sdk - all versions < 2024.10+1
EPSS score
0.27%
An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution.7.8CVE-2023-5180open design allianceoda drawings sdk - all versions < 2024.12+1
EPSS score
0.19%
An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.