SAP 3D Visual Enterprise Author 9 SAT File CoreCadTranslator.exe memory corruption

Summaryinfo

A vulnerability labeled as critical has been found in SAP 3D Visual Enterprise Author 9. Affected is an unknown function of the file CoreCadTranslator.exe of the component SAT File Handler. Executing a manipulation can lead to memory corruption. This vulnerability is tracked as CVE-2022-39803. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as critical was found in SAP 3D Visual Enterprise Author 9. This vulnerability affects an unknown part of the file CoreCadTranslator.exe of the component SAT File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Due to lack of proper memory management, when a victim opens a manipulated ACIS Part and Assembly (.sat, CoreCadTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.

The weakness was disclosed 10/12/2022. The advisory is available at launchpad.support.sap.com. This vulnerability was named CVE-2022-39803 since 09/02/2022. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/02/2026).

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-42248). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Image Processing Software

Vendor

• SAP

Name

• 3D Visual Enterprise Author

Version

• 9

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion