ZDI-CAN-22615: ZDI-24-428: Dassault Systèmes eDrawings Viewer JT File Parsing Memory Corruption Remote Code Execution Vulnerability

Published May 9, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dassault Syst��mes eDrawings Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-1847.

Affected Software

1 affected component

Dassault Systèmes eDrawings Viewer

Event History

May 9, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-22615?

ZDI-CAN-22615 is a high-severity vulnerability that enables remote code execution on affected systems.

How do I fix ZDI-CAN-22615?

To fix ZDI-CAN-22615, update the Dassault Systèmes eDrawings Viewer to the latest version provided by the vendor.

Who is affected by ZDI-CAN-22615?

ZDI-CAN-22615 affects installations of Dassault Systèmes eDrawings Viewer prior to the security patch release.

What type of attack does ZDI-CAN-22615 allow?

ZDI-CAN-22615 allows remote attackers to execute arbitrary code on affected systems through user interaction.

Is user interaction required for ZDI-CAN-22615 exploitation?

Yes, user interaction is required as the target must visit a malicious page or open a malicious file.