Data Device dataSIMS Avionics ARINC 4.5.3 on Windows File stack-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in Data Device dataSIMS Avionics ARINC 4.5.3 on Windows. Affected by this issue is some unknown functionality of the component File Handler. This manipulation causes stack-based overflow. This vulnerability appears as CVE-2021-47881. The attack requires local access. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Data Device dataSIMS Avionics ARINC 4.5.3 on Windows. It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component File Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to overwrite memory by manipulating the milstd1553result.txt file. Attackers can craft a malicious file with carefully constructed payload and alignment sections to potentially execute arbitrary code on the Windows system.

The weakness was presented by Kağan Çapar as 49577. The advisory is shared at exploit-db.com. This vulnerability is known as CVE-2021-47881 since 01/18/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (49577). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Data Device

Name

• dataSIMS Avionics ARINC

Version

• 4.5.3

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion