PT-2025-52653 · Open Design Alliance · Drawings Sdk

Published 2025-12-22 · Updated 2025-12-22 · CVE-2025-10021

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2026.12

Description A Use of Uninitialized Variable issue exists in the software. A static object COdaMfcAppApp theApp may access OdString::kEmpty before its initialization. This is due to undefined initialization order of static objects across translation units, known as a Static Initialization Order Fiasco. This can lead to an application crash on startup, resulting in a denial of service. While memory corruption and arbitrary code execution cannot be ruled out, they are specific to certain exploitation scenarios.

Recommendations Update to version 2026.12 or later.

Fix

DoS

Weakness Enumeration

CWE-457

Related Identifiers

CVE-2025-10021

Affected Products

Drawings Sdk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10021 · Security Note
• https://t.me/CVEtracker/40416 · Telegram Post
• https://twitter.com/CVEnew/status/2003198584435433937 · Twitter Post
• https://twitter.com/BugBountyShorts/status/2003147945688920147 · Twitter Post
• https://opendesign.com/security-advisories · Note
• https://t.me/cveNotify/146540 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2003142428664992118 · Twitter Post