CVE-2021-32940

Name of the Vulnerable Software and Affected Versions Open Design Alliance (ODA) Drawing SDK versions prior to 2022.5

Description The issue is related to an out-of-bounds read in the DWG file-recovering procedure due to the lack of proper validation of user-supplied data. This can cause a read past the end of an allocated buffer, allowing attackers to cause a denial-of-service condition or read sensitive information from memory locations.

Recommendations For versions prior to 2022.5, update to version 2022.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DWG file-recovering procedure in the Drawings SDK until a patch is available. Avoid using the Drawings SDK to parse untrusted DWG files until the issue is resolved.