« Volver al listado

CVE-2021-27036

Estado: ModificadaAlta (7.8)—

A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD or TIFF files. This vulnerability can be exploited to execute arbitrary code

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Autodesk — Design Review

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27036",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@autodesk.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Autodesk Design Review",
          "versions": [
            {
              "status": "affected",
              "version": "2018, 2017, 2013, 2012, 2011"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-09T15:15:08.040",
  "references": [
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PICT, RCL, BMP, PSD or TIFF files. This vulnerability can be exploited to execute arbitrary code"
    },
    {
      "lang": "es",
      "value": "Un archivo PCX, PICT, RCL, TIF, BMP, PSD o TIFF malicioso puede utilizarse para escribir más allá del búfer asignado mientras se analizan archivos PCX, PDF, PICT, RCL, BMP, PSD o TIFF. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario"
    }
  ],
  "lastModified": "2026-06-17T03:44:10.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2011:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83CF6CDF-806C-4DC5-B572-C1C2BC2C25F2"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2012:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A78B6F8-DF84-4E6C-A247-0F6D2F8CA679"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCD2CA9B-16E1-4BE7-A4E1-A9817A503958"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2017:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31F2529F-ECF0-4568-BBDC-82B396A52332"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "213232B9-A40B-436D-A66A-B65C49D59BE6"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:hotfix:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D0CF4DC-ACA5-41D0-B28E-CEB5D2C96F71"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:hotfix2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84ED1789-A17F-48F7-A152-09D2A5C59254"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:design_review:2018:hotfix3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74819924-EB63-4BBF-9986-FEF6100EEE15"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@autodesk.com"
}