Remote Code Execution Vulnerability in SAP 3D Visual Enterprise Viewer

CVE-2022-41186

What is CVE-2022-41186?

A vulnerability in SAP 3D Visual Enterprise Viewer arises from inadequate memory management, enabling attackers to execute remote code. This occurs when users open a specially crafted Computer Graphics Metafile (.cgm) file through CgmCore.dll originating from untrusted sources. The exploit triggers a stack-based overflow and may also involve the re-use of dangling pointers that reference overwritten memory regions, exposing systems to potential compromise.

References