CVE-2022-40644: 
Ansys SpaceClaim vulnerability analysis and mitigation

A remote code execution vulnerability exists in Ansys SpaceClaim 2022 R1 that allows attackers to execute arbitrary code. The vulnerability (CVE-2022-40644) was discovered in July 2022 and publicly disclosed on September 14, 2022. The issue specifically affects the parsing of X_B files in SpaceClaim software (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data during the parsing of X_B files, which can result in a write past the end of an allocated data structure. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a high severity level (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically that the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability has been fixed in Ansys SpaceClaim 2023 R2. Users are advised to upgrade to this version to protect against potential exploitation (ZDI Advisory).