CVE-2021-21449: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a vulnerability (CVE-2021-21449) that was disclosed on January 12, 2021. The vulnerability allows an attacker to cause the application to crash by opening a manipulated IFF file received from untrusted sources, making it temporarily unavailable until the user restarts the application. This vulnerability stems from improper input validation (NIST, ZDI).

The vulnerability has a CVSS v3.1 base score of 7.8 (High) with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the parsing of IFF files and results from the lack of proper validation of user-supplied data, which can lead to a memory corruption condition (ZDI).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The application becomes temporarily unavailable until the user restarts it, affecting the availability of the service (NIST, ZDI).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges for execution (ZDI).

The vulnerability was fixed with the release of VE Viewer 9.0 FP10. Users are advised to update to this version or later to mitigate the vulnerability (ZDI).