CVE-2023-26495 — Use After Free in Drawings SDK

CWE-416 — Use After Free3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 74.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Opendesign Drawings SDK
Timeline
PublishedApr 10

Description

An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-f5cj-2ghc-vgwm: An issue was discovered in Open Design Alliance Drawings SDK before 2024↗2023-04-10
▶
CVEList
CVE-2023-26495: An issue was discovered in Open Design Alliance Drawings SDK before 2024↗2023-04-10
▶
CVE-2023-26495 — Use After Free in Drawings SDK | cvebase