CVEvulnerability

CVE-2025-10021

7.0 HIGH Published 2025-12-22 Modified 2026-10-23 Official page ↗
Status
Deferred
Published
2025-12-22
Last modified
2026-10-23
Assigner
8a9629cb-c5e7-4d2a-a894-111e8039b7ea
CVSS 4.0 (8a9629cb-c5e7-4d2a-a894-111e8039b7ea)
7.0 HIGH — CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Amber
Weaknesses
CWE-457

Description

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior,  memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.

Related

Weakness · CWE (1)

  • CWE-457 Use of Uninitialized Variable weakness

References