CVE-2021-21461: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2021-21461 affects SAP 3D Visual Enterprise Viewer version 9, where a vulnerability exists in the BMP file parsing functionality. The vulnerability was discovered and reported on October 21, 2020, and was publicly disclosed on January 12, 2021. The issue stems from improper input validation when handling BMP files from untrusted sources (ZDI Advisory, CVE Mitre).

The vulnerability is characterized by improper validation of user-supplied data during BMP file parsing, which can result in a write past the end of an allocated data structure. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity. User interaction is required for exploitation, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. Additionally, opening a manipulated BMP file can result in the application crashing and becoming temporarily unavailable until the user restarts the application (CVE Mitre, ZDI Advisory).

The vulnerability requires user interaction for exploitation, specifically opening a malicious BMP file or visiting a malicious page. The attack complexity is considered low, requiring no privileges for execution, though user interaction is required (ZDI Advisory).

The vulnerability has been fixed with the release of VE Viewer 9.0 FP10. Users are advised to update to this version or later to mitigate the vulnerability (ZDI Advisory).