PT-2023-21267 · Dassault Systèmes · Solidworks

Mat Powell · Published 2023-07-12 · Updated 2024-09-02 · CVE-2023-2763

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOLIDWORKS Desktop versions Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023

Description The issue exists in the DWG and DXF file reading procedure, allowing an attacker to execute arbitrary code while opening a specially crafted file. This is due to Use-After-Free, Out-of-bounds Write, and Heap-based Buffer Overflow vulnerabilities.

Recommendations For versions Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023, consider avoiding the use of DWG and DXF file reading procedures until a patch is available. As a temporary workaround, restrict the opening of specially crafted DWG or DXF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-416

CWE-787

CWE-122

Related Identifiers

CVE-2023-2763

ZDI-23-908

ZDI-23-910

ZDI-23-911

ZDI-23-912

Affected Products

Solidworks

References · 10

• https://zerodayinitiative.com/advisories/ZDI-23-911 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2763 · Security Note
• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-908 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-910 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-912 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2763 · Vendor Advisory
• https://t.me/cvenotify/54695 · Telegram Post
• https://t.me/cibsecurity/66492 · Telegram Post
• https://t.me/cvenotify/92988 · Telegram Post