Vulnerability · Published Jul 12, 2023 · Assigned by 3DS
CVE-2023-2762Use-After-Free vulnerability in SLDPRT file reading procedure affecting SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023
High 7.8
In plain English
A high-severity use-after-free in SOLIDWORKS Desktop from Dassault Systèmes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 70.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dassault Systèmes | SOLIDWORKS Desktop | Release SOLIDWORKS 2021 Golden – through Release SOLIDWORKS 2021 SP5.1Release SOLIDWORKS 2022 Golden – through Release SOLIDWORKS 2022 SP5Release SOLIDWORKS 2023 Golden – through Release SOLIDWORKS 2023 SP2 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H