CVE-2021-31784
An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configuration.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configuration. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart) or possible code execution.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.85% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- opendesign/drawings sdk · siemens/comos
- Source
- cve@mitre.org
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdfPatch, Third Party Advisory
- https://www.opendesign.com/security-advisoriesVendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdfPatch, Third Party Advisory
- https://www.opendesign.com/security-advisoriesVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.