RCE via stack overflow in SAP 3D Visual Enterprise Viewer 9
CVE-2022-41202 Published on October 11, 2022

Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.

NVD

Vulnerability Analysis

CVE-2022-41202 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Types

What is a Buffer Overflow Vulnerability?

The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

CVE-2022-41202 has been classified to as a Buffer Overflow vulnerability or weakness.

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2022-41202 has been classified to as a Memory Corruption vulnerability or weakness.


Products Associated with CVE-2022-41202

Want to know whenever a new CVE is published for SAP 3d Visual Enterprise Viewer? stack.watch will email you.

SAP 3d Visual Enterprise Viewer
 

Affected Versions

SAP SE SAP 3D Visual Enterprise Viewer Version 9 is affected by CVE-2022-41202

Exploit Probability

EPSS
1.77%
Percentile
82.40%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.