CVE-2025-10021: High severity Open Design Alliance Drawings SDK vulnerability
A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object COdaMfcAppApp theApp may access OdString::kEmpty before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior, memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10021?
The severity of CVE-2025-10021 has not been explicitly rated, but it is considered a potential security risk due to the use of uninitialized variables.
How do I fix CVE-2025-10021?
To fix CVE-2025-10021, update to Open Design Alliance Drawings SDK version 2026.12 or later.
What causes CVE-2025-10021?
CVE-2025-10021 is caused by the access of an uninitialized static variable in the Open Design Alliance Drawings SDK.
Is CVE-2025-10021 present in my version of Open Design Alliance Drawings SDK?
CVE-2025-10021 affects static versions of Open Design Alliance Drawings SDK prior to version 2026.12.
What impact could CVE-2025-10021 have on my application?
CVE-2025-10021 could lead to undefined behavior in applications using the affected versions of the Drawings SDK.