CVE-2023-22670

Vulnerability

A heap-based buffer overflow exists in the DXF file reading procedure of Open Design Alliance Drawings SDK versions prior to 2023.6. The flaw occurs during parsing of DXF files when user-supplied XRecord data is copied to a fixed-length heap-based buffer without proper length validation. This allows an attacker to overflow the buffer.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted DXF file to an application using the vulnerable SDK. No authentication is required; the victim must open the malicious file. The attacker does not need any special network position beyond delivering the file.

Impact

Successful exploitation leads to arbitrary code execution in the context of the current process. The attacker gains the same privileges as the user running the application, potentially leading to full system compromise.

Mitigation

The vulnerability is fixed in Open Design Alliance Drawings SDK version 2023.6 [1]. Users should update to this version or later. No workarounds are documented. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.