Vulnerability · Published Oct 11, 2022 · Assigned by sap

CVE-2022-41191

High 7.8

In plain English

A high-severity memory corruption in SAP 3D Visual Enterprise Viewer from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.6%top 49.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP 3D Visual Enterprise Viewer	9

Weakness: CWE-119, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References