CVE-2019-10996 is a use-after-free vulnerability affecting Red Lion Controls Crimson software, specifically versions 3.0 and prior, and version 3.1 prior to release 3112.00. This high-severity vulnerability (CVSS 7.8) requires user interaction, as an attacker must trick a valid user into opening a specially crafted, malicious input file. Successful exploitation could lead to high confidentiality, integrity, and availability impacts. There is no public exploit code available, it is not listed in CISA's KEV catalog, and community discussion and media coverage are minimal, suggesting limited active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.0CPE matchmatch criteria | cpe:2.3:a:redlion:crimson:*:*:*:*:*:*:*:* | ||
>= 3.1, < 3112.00CPE matchmatch criteria | cpe:2.3:a:redlion:crimson:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.