Threat Investigation
Request a demo

CVE-2022-41198

High

Description

Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.

SeverityHigh
CVSS7.8
Exploit probability—
ProductSap 3d Visual Enterprise Viewer
PublishedOct 11, 2022
First seenOct 11, 2022
Weakness typeCWE-119Memory buffer bounds errorCWE-787Out-of-bounds write

How to fix

Update
  • sap 3d_visual_enterprise_viewer9.0 or later

Affected products

ProductAffected versionsFixed in
sap 3d_visual_enterprise_viewerv < 9.09.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.