CVE-2021-25174

Vulnerability

A memory corruption vulnerability exists in Open Design Alliance Drawings SDK versions prior to 2021.12 [1]. The flaw occurs when the SDK parses malformed DGN files, due to improper validation of user-supplied data. This can lead to a crash or potentially allow an attacker to execute arbitrary code [2].

Exploitation

To exploit this vulnerability, an attacker must convince a user to open a specially crafted DGN file, either by downloading and opening it or by visiting a malicious web page that triggers parsing. No prior authentication is required, but user interaction is necessary [2]. The attacker supplies a malformed DGN file that triggers memory corruption during parsing.

Impact

Successful exploitation can cause the application to crash, resulting in denial of service. According to the ZDI advisory, the vulnerability may also allow remote code execution in the context of the current process, with high impact on confidentiality, integrity, and availability (CVSS 7.8) [2].

Mitigation

The vulnerability is fixed in Open Design Alliance Drawings SDK version 2021.12 [1]. Users and vendors (e.g., Siemens JT2Go) should update to the latest SDK version. Until patched, avoid opening untrusted DGN files. No other workaround is available.