CVE-2023-42131: 
Ansys SpaceClaim vulnerability analysis and mitigation

CVE-2023-42131 is a remote code execution vulnerability in Ansys SpaceClaim that was discovered in July 2022 and publicly disclosed on October 4, 2023. The vulnerability affects the X_B file parsing functionality in Ansys SpaceClaim versions prior to 2023 R2 (ZDI Advisory).

The vulnerability exists within the parsing of X_B files in Ansys SpaceClaim. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in an out-of-bounds write past the end of an allocated data structure. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process, potentially leading to complete system compromise with the privileges of the affected application (ZDI Advisory).

The vulnerability has been fixed in Ansys SpaceClaim 2023 R2. Users are advised to upgrade to this version or later to mitigate the risk (ZDI Advisory).