CVE-2024-1847 describes multiple memory corruption vulnerabilities, including heap-based and stack-based buffer overflows, in eDrawings from SOLIDWORKS 2023 through 2024. These flaws arise during the file reading procedure for various CAD file types (e.g., CATPART, IPT, STP). With a CVSS score of 7.8 (HIGH), successful exploitation could allow an unauthenticated attacker to execute arbitrary code on a user's system by tricking them into opening a specially crafted malicious file. While no public exploits or active exploitation have been observed, the vulnerability carries significant risk due to its potential for full system compromise.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2023, < 2024CPE matchmatch criteria | cpe:2.3:a:3ds:solidworks:*:*:*:*:*:*:*:* | ||
2024CPE matchmatch criteria | cpe:2.3:a:3ds:solidworks:2024:-:*:*:*:*:*:* | ||
2024CPE matchmatch criteria | cpe:2.3:a:3ds:solidworks:2024:sp1.0:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.