Open Design Alliance
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| CDE inWEB SDK | 1 | – | Dec 12, 2024 |
| ODA Drawings SDK - All Versions < 2024.10 | 1 | – | Nov 7, 2023 |
| ODA Drawings SDK - All Versions < 2024.12 | 1 | – | Dec 26, 2023 |
| ODA Drawings SDK - All Versions < 2025.10 | 1 | – | Dec 4, 2024 |
| ODA Drawings SDK - All Versions < 2026.12 | 1 | – | Dec 22, 2025 |
Exploited and recent CVEs
- CVE-2025-10021 A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before 0.2%
- CVE-2024-12564 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3 0.7%
- CVE-2024-8894 Out-of-bounds Write vulnerability in ODA SDK versions < 2025.10 0.2%
- CVE-2023-5180 Out-of-bounds Write vulnerability exists in ODA Drawings SDK before 2024.12 0.2%
- CVE-2023-5179 An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow atta 0.3%