title: CVE-2023-22295
description: Datakit CrossCadWare_x64.dll contains an out of bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.
problem types: CWE-125 Out-of-bounds Read
affected:
{
defaultStatus: unaffected
product: CrossCAD/Ware_x64 library
vendor: Datakit
versions:
lessThan: 2023.1, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Datakit recommends user upgrade to  v2023.1 https://www.datakit.com/en/crosscad_ware.php  or later.
workarounds: Datakit has identified specific workarounds and mitigations that should be applied to reduce the risk:
*  Do not open untrusted SLDPRT files with CrossCAD/Ware
*  Update CrossCAD/Ware to 2023.1 or a later version.