CVE-2021-21450: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2021-21450 affects SAP 3D Visual Enterprise Viewer version 9, discovered and disclosed in January 2021. The vulnerability allows users to open manipulated PSD files from untrusted sources, which can result in the application crashing and becoming temporarily unavailable until restart (CVE Details).

The vulnerability stems from improper input validation when processing PSD files in SAP 3D Visual Enterprise Viewer. It has been assigned a CVSS v3 score of 7.8 (High) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically exists within the parsing of PSD files and results from the lack of proper validation of user-supplied data, which can lead to a memory corruption condition (ZDI).

When successfully exploited, this vulnerability can cause the application to crash and become temporarily unavailable until the user restarts the application. An attacker can leverage this vulnerability to execute code in the context of the current process (ZDI).

The vulnerability requires user interaction to exploit, as the target must open a malicious PSD file. The attack can be executed by remote attackers, though user interaction is required to open the malicious file (ZDI).

The vulnerability was fixed with the release of VE Viewer 9.0 FP10. Users are advised to update to this version or later to mitigate the vulnerability (ZDI).