CVE-2022-41189: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in SAP 3D Visual Enterprise Viewer affecting the parsing of DWG files. The vulnerability, identified as CVE-2022-41189, was reported on June 30, 2022, and publicly disclosed on November 3, 2022. This security flaw affects installations of SAP 3D Visual Enterprise Viewer when processing AutoCAD (.dwg) files through TeighaTranslator.exe (ZDI Advisory).

The vulnerability has been assigned a CVSS score of 5.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The specific flaw exists within the parsing of DWG files and results from the lack of validating the existence of an object prior to performing operations on the object. This vulnerability is classified under CWE-119 and CWE-787, indicating improper memory handling (ZDI Advisory, NVD Report).

When successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of SAP 3D Visual Enterprise Viewer (ZDI Advisory).

SAP has released an update to address this vulnerability. Users are advised to apply the security patch as detailed in the SAP security advisory (ZDI Advisory).