title: Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023
description: Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.
problem types: CWE-416 Use After Free
affected:
{
vendor: Dassault Systèmes
product: SOLIDWORKS Desktop
versions:
status: affected, version: Release SOLIDWORKS 2021 Golden, lessThanOrEqual: Release SOLIDWORKS 2021 SP5.1, versionType: custom
status: affected, version: Release SOLIDWORKS 2022 Golden, lessThanOrEqual: Release SOLIDWORKS 2022 SP5, versionType: custom
status: affected, version: Release SOLIDWORKS 2023 Golden, lessThanOrEqual: Release SOLIDWORKS 2023 SP2, versionType: custom
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
]