High severity · published Nov 14, 2021
CVE-2021-43279
An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10
7.8
CVSS
1.3%
EPSS
No
On KEV
Description
An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Oda Prc Software Development Kit · Opendesign
before 2022.10 · source: NVD
Affected product
OP
Oda Prc Software Development Kit
Opendesign
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43279
Vendor Advisory
https://www.opendesign.com/security-advisories
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1337/
More from Oda Prc Software Development Kit
7.8
CVE-2021-43277
An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10