CVE-2021-32946

Vulnerability

The improper check for unusual or exceptional conditions exists within the parsing of DGN files in Open Design Alliance Drawings SDK versions prior to 2022.4, and version 2022.4 is also affected [1]. The vulnerability results from the lack of proper validation of user-supplied data, specifically an out-of-bounds write issue that can lead to a heap-based buffer overflow [2][3].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted DGN file, for instance, by visiting a malicious page or opening a malicious file in an application that uses the Drawings SDK, such as Siemens JT2Go [2][3]. The user interaction required is opening the file; no additional privileges are needed beyond local access. The issue can be triggered without authentication [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process or cause a denial-of-service condition. The CVSS v3 score is 7.8 (High) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high impact to confidentiality, integrity, and availability [1][2][3].

Mitigation

Users should update Drawings SDK to version 2022.5 or later, as the vendor has released a fix [1]. For Siemens JT2Go, the advisory from ZDI recommends applying the vendor-provided patch when available [2][3]. If an immediate update is not possible, avoid opening untrusted DGN files from unknown sources.