CVE-2021-32944
High
Description
A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a memory corruption or arbitrary code execution, allowing attackers to cause a denial-of-service condition or execute code in the context of the current process.
SeverityHigh
CVSS7.8
Exploit probability—
ProductOpendesign Drawings Sdk
PublishedJun 17, 2021
First seenJun 17, 2021
Weakness typeCWE-416Use after free
How to fix
Update
- opendesign drawings_sdk2022.4 or later
- siemens comos10.4.1 or later
- siemens jt2go13.2.0.1 or later
- siemens teamcenter_visualization13.2.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opendesign drawings_sdk | v < 2022.4 | 2022.4 |
| siemens comos | v < 10.4.1 | 10.4.1 |
| siemens jt2go | v < 13.2.0.1 | 13.2.0.1 |
| siemens teamcenter_visualization | v < 13.2.0.1 | 13.2.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.