CVE-2021-43280

Vulnerability

A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance (ODA) Drawings SDK and Drawings Explorer. The flaw results from the lack of proper validation of user-supplied data length before copying it to a stack-based buffer. Affected versions are those before 2022.8. The vulnerability occurs during parsing of DWF files [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted DWF file or visit a malicious page. No authentication is required, but user interaction is necessary. The attack vector is local (low complexity), and the attacker does not need special privileges. The CVSS score is 7.8 [2][3][4].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system [1][2][3][4].

Mitigation

The vulnerability is fixed in ODA Drawings SDK version 2022.8. Users should update to this or a later version as soon as possible. No workarounds are mentioned in the available references [1][2][3][4].