CVE-2022-40654: 
Ansys SpaceClaim vulnerability analysis and mitigation

CVE-2022-40654 is a remote code execution vulnerability affecting Ansys SpaceClaim 2022 R1. The vulnerability was discovered on August 25, 2022, and publicly disclosed on September 14, 2022. The issue specifically exists within the parsing of X_T files in the software (ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data when parsing X_T files, which can result in a write past the end of an allocated data structure. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a high severity level (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process on affected installations of Ansys SpaceClaim. The exploitation requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a user to visit a malicious page or open a malicious file to trigger the vulnerability (ZDI Advisory).

The vulnerability has been fixed in Ansys SpaceClaim 2023 R2. Users are advised to upgrade to this version to protect against potential exploitation (ZDI Advisory).