CVE-2021-32950

Vulnerability

An out-of-bounds read vulnerability exists in the DXF file parsing component of the Open Design Alliance Drawings SDK, affecting all versions prior to 2022.4 [1]. The issue stems from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer [2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted DXF file, either by visiting a malicious webpage or opening a malicious file attachment [2]. No authentication is required, but user interaction is necessary. The attack complexity is low [1].

Impact

Successful exploitation allows an attacker to cause a denial-of-service condition or read sensitive information from memory [1]. The CVSS v3 base score for this specific out-of-bounds read is 4.4 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) according to CISA [1], while the ZDI advisory lists a CVSS score of 3.3 under similar vector string [2]. The attacker may also leverage this vulnerability in conjunction with others to achieve arbitrary code execution in the context of the current process [2].

Mitigation

Open Design Alliance has released Drawings SDK version 2022.4, which contains fixes for this vulnerability [1]. Users are advised to upgrade to version 2022.4 or later. No known workarounds have been provided [1].