CVE-2023-2762

Published: Jul 12, 2023Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.

Affected (1)

Products: 3ds: 3dexperience Solidworks

1 product

3dexperience Solidworks

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
3ds 3dexperience Solidworks	From 2021 to 2023

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (2)

https://www.3ds.com/vulnerability/advisories

Source: 3DS.Information-Security@3ds.com

Vendor Advisory

https://www.3ds.com/vulnerability/advisories

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.