CVE-2021-44422

Vulnerability

An improper input validation vulnerability exists in the BMP file reading functionality of Open Design Alliance Drawings SDK versions prior to 2022.12 [1]. Crafted data in a BMP file can trigger a write operation past the end of an allocated buffer, leading to a heap-based buffer overflow. The issue is reachable when the SDK processes a malicious BMP file.

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted BMP file to a user or application that utilizes the affected SDK. No authentication is required; the victim must open the malicious file. The attacker can embed arbitrary data in the BMP to trigger the overflow during parsing.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. The attacker gains the same privileges as the user running the application, potentially leading to full system compromise depending on the user's permissions.

Mitigation

The vulnerability is fixed in Open Design Alliance Drawings SDK version 2022.12 [1]. Users should update to this version or later. No workarounds are documented. The CVE is not listed in the Known Exploited Vulnerabilities catalog.