CVE-2023-22669 — Vulnetix

CVE-2023-22669 PUBLISHED CVSS 7.800000190734863 HIGH

Parsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

EPSS 0.06% · 19.4th percentile

Risk Scores

CVSS 3.1

7.800000190734863

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

0.06%

19.4th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	*
opendesign	drawings_sdk	0, 0, 0

Exploit Intelligence

https://www.opendesign.com/security-advisories (circl)
rules.yar (github-yara)
rules.yar (github-yara)
rules.yar (github-yara)
rules.yar (github-yara)
rules.yar (github-yara)
CVE-2023-4863.yar (github-yara)
CVE-2023-4863.yar (github-yara)
CVE-2023-4863.yar (github-yara)
CVE-2023-4863.yar (github-yara)

…and 6 more exploits

Timeline

Apr 15, 2023 CVE Published
Apr 15, 2023 EPSS Score
May 23, 2023 EPSS Score
Jun 29, 2023 EPSS Score
Aug 6, 2023 EPSS Score
Sep 12, 2023 EPSS Score
Oct 5, 2023 PoC Published
Oct 20, 2023 EPSS Score
Nov 27, 2023 EPSS Score
Jan 3, 2024 EPSS Score
Feb 10, 2024 EPSS Score
Mar 19, 2024 EPSS Score

References

Open in Interactive Console →