Out-of-Bounds Read Vulnerability in FontManager of Critical Application
CVE-2023-32281

7.8HIGH

Key Information:

Vendor

Horner Automation

Status
Cscape
Cscape EnvisionRV
Vendor
CVE Published:
6 June 2023

What is CVE-2023-32281?

The affected application is susceptible to an out-of-bounds read vulnerability found in the FontManager. This issue arises due to inadequate validation of user-supplied data when processing project files, such as CSP. Exploiting this vulnerability could allow an attacker to execute arbitrary code in the context of the current process, potentially compromising the integrity and security of the application. It is essential for users of the affected versions to apply necessary updates promptly to mitigate risks associated with this vulnerability.

Affected Version(s)

Cscape v9.90 SP8

Cscape EnvisionRV v4.70

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Heinzl reported these vulnerabilities to CISA.
.