CVE-2021-43582

Vulnerability

A use-after-free vulnerability exists in the Open Design Alliance Drawings SDK versions prior to 2022.11 [1]. The specific flaw occurs during the parsing of DWG files, within the Drawings Explorer component [2]. The issue results from the lack of validating the existence of an object prior to performing operations on it, leading to a use-after-free condition [2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted DWG file or to visit a malicious page that triggers the file parsing [2]. User interaction is required. No additional privileges are needed beyond the ability to deliver the file to the target [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process [1][2]. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability (CIA) impacts [2].

Mitigation

The vulnerability is fixed in Open Design Alliance Drawings SDK version 2022.11 [1]. Users should update to this version or later. No workarounds are documented in the available references [1][2].