CVE-2021-44047

Vulnerability

A use-after-free vulnerability exists in the Open Design Alliance Drawings SDK before version 2022.11 when parsing DWF or DWFX files. The lack of proper input validation on crafted data can trigger a write operation past the end of an allocated buffer, leading to memory corruption.

Exploitation

An attacker must supply a specially crafted DWF or DWFX file to a victim who opens it using an application built with the vulnerable SDK version. No additional authentication or network position is required beyond delivering the file (e.g., via email or download). The exploit occurs during the parsing of the malformed file data.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process. This can lead to full compromise of the user's system, including data theft, installation of malware, or further lateral movement within an organization.

Mitigation

Upgrade to Open Design Alliance Drawings SDK version 2022.11 or later, as specified in the vendor advisory [1]. No workaround is available for users who cannot immediately update. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities catalog as of this writing.