CVE-2022-41211: Buffer Overflow
Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload forces:Re-use of dangling pointer which refers to overwritten space in memory. The accessed memory must be filled with code to execute the attack. Therefore, repeated success is unlikely.Stack-based buffer overflow. Since the memory overwritten is random, based on access rights of the memory, repeated success is not assured.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-41211?
CVE-2022-41211 is a vulnerability in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer that allows Arbitrary Code Execution when opening manipulated files from untrusted sources.
How does CVE-2022-41211 work?
CVE-2022-41211 occurs due to a lack of proper memory management, which leads to the re-use of a dangling pointer that refers to overwritten data, enabling Arbitrary Code Execution.
What is the severity of CVE-2022-41211?
CVE-2022-41211 has a severity rating of 7.8, classified as high.
Which software versions are affected by CVE-2022-41211?
SAP 3D Visual Enterprise Author version 9 and SAP 3D Visual Enterprise Viewer version 9 are affected by CVE-2022-41211.
How can I fix CVE-2022-41211?
To mitigate CVE-2022-41211, it is recommended to apply the necessary patches and updates provided by SAP. Please refer to the official SAP notes and documentation for detailed instructions.