CVE-2021-27596: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. This vulnerability, identified as CVE-2021-27596, was discovered and disclosed in March 2021 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 LOW by NIST with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. However, SAP SE assessed it with a higher CVSS score of 4.3 MEDIUM with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The vulnerability affects SAP 3D Visual Enterprise Viewer version 9 (NVD).

The vulnerability impacts the availability of the SAP 3D Visual Enterprise Viewer application. When exploited, it causes the application to crash, making it temporarily unavailable until the user restarts the application (NVD).

The vulnerability requires user interaction to be exploited, specifically opening a maliciously crafted .3DS file from untrusted sources. The attack complexity is considered low, and no privileges are required to execute the attack (NVD).

Users should exercise caution when opening .3DS files from untrusted sources. SAP has released security notes and patches to address this vulnerability, which can be found in SAP Security Note 3035472 (SAP Note).