What is CVE-2024-3298?

CVE-2024-3298 is a high-severity vulnerability in Dassault Systèmes Edrawings, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2024-04-04.

How severe is CVE-2024-3298?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2024-3298 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Dassault Systèmes Edrawings

CVE-2024-3298

Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF. NOTE: this vulnerability was SPLIT from CVE-2024-1847.

Vulnerability class: Buffer Overflow

EPSS: 0.003 (24.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Dassault Systèmes Edrawings — versions Release SOLIDWORKS 2023 SP0, Release SOLIDWORKS 2024 SP0

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

3DS.Information-Security@3ds.com

Frequently asked questions

What is CVE-2024-3298?: CVE-2024-3298 is a high-severity vulnerability in Dassault Systèmes Edrawings, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2024-04-04.
How severe is CVE-2024-3298?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2024-3298 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.