CVE-2021-43277

Vulnerability

An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before version 2022.10. Crafted data in a U3D file can cause a read past the end of an allocated buffer. This affects all versions prior to the fix. [1]

Exploitation

An attacker can exploit this by providing a specially crafted U3D file to an application using the vulnerable SDK. No authentication is required if the application processes untrusted U3D files. The attacker must convince the user or process to open the malicious file. The out-of-bounds read can be leveraged in conjunction with other vulnerabilities to achieve code execution.

Impact

Successful exploitation can lead to arbitrary code execution in the context of the current process. This could result in full compromise of the application and potentially the underlying system, depending on the process privileges.

Mitigation

The vulnerability is fixed in ODA PRC SDK version 2022.10. Users should update to this version or later. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.