CVE-2021-43336: opendesign drawings_software_development_kit Out-of-bounds Write
Vulnerability summary
CVE-2021-43336 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in opendesign drawings_software_development_kit. EPSS estimates a 1.70% chance of exploitation in the next 30 days, higher than 76.7% of scored vulnerabilities.
Timeline
- 14-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.70%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.70% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Siemens2 products
- solid_edgese2022
- teamcenter_visualization≥ 12.4.0, < 12.4.0.13 | ≥ 13.2.0, < 13.3.0.1 | 13.1.0
Opendesign1 product
- drawings_software_development_kit< 2022.11
2 vendors · 3 products
References
4 links- www.opendesign.com/security-advisoriesVendor Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-301589.pdfThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-491245.pdfThird Party Advisory