CVE-2021-21459: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2021-21459 affects SAP 3D Visual Enterprise Viewer version 9, which contains a vulnerability related to improper input validation when processing IFF files. The vulnerability was discovered and disclosed on January 12, 2021 (ZDI Advisory, CVE Mitre).

The vulnerability exists within the parsing of IFF files and results from the lack of proper validation of user-supplied data. This can lead to a write past the end of an allocated data structure. The vulnerability has been assigned a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (ZDI Advisory).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of SAP 3D Visual Enterprise Viewer. The vulnerability can lead to the application crashing and becoming temporarily unavailable until the user restarts it (CVE Mitre).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. An attacker can leverage this vulnerability to execute code in the context of the current process (ZDI Advisory).

The vulnerability was fixed with the release of VE Viewer 9.0 FP10 (ZDI Advisory).