CVE-2020-6354: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a use-after-free vulnerability (CVE-2020-6354) that was discovered in September 2020. The vulnerability allows remote attackers to execute arbitrary code when a user opens a malicious SKP file (ZDI Advisory).

The vulnerability exists within the parsing of SKP files and results from the lack of validating the existence of an object prior to performing operations on the object. The issue has been assigned a CVSS v3.1 base score of 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) (NVD).

A successful exploit could allow an attacker to execute code in the context of the current process at low integrity. The application becomes temporarily unavailable until the user restarts it when a manipulated SKP file from untrusted sources is opened (NVD).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. An attacker can leverage this vulnerability through specially crafted SKP files (ZDI Advisory).

SAP has issued an update to correct this vulnerability. Users should apply the security patch provided by SAP (ZDI Advisory).