CVE-2025-10021

{
  "id": "CVE-2025-10021",
  "sourceIdentifier": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea",
  "published": "2025-12-22T16:15:43.437",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior,  memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de uso de variable no inicializada en las versiones estáticas (mt) del Open Design Alliance Drawings SDK anteriores a la 2026.12. El objeto estático ’COdaMfcAppApp theApp’ puede acceder a ’OdString::kEmpty’ antes de su inicialización. Debido al orden de inicialización indefinido de objetos estáticos entre unidades de traducción (Fiasco del orden de inicialización estática), la aplicación accede a memoria no inicializada. Esto provoca un bloqueo de la aplicación al iniciar, causando una denegación de servicio. Debido al comportamiento indefinido, la corrupción de memoria y la posible ejecución de código arbitrario no pueden descartarse en escenarios de explotación específicos."
    }
  ],
  "affected": [
    {
      "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea",
      "affectedData": [
        {
          "vendor": "Open Design Alliance",
          "product": "ODA Drawings SDK - All Versions < 2026.12",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "2026.12",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Amber",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "YES",
          "Recovery": "USER",
          "valueDensity": "DIFFUSE",
          "vulnerabilityResponseEffort": "LOW",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-22T16:07:39.802296Z",
          "id": "CVE-2025-10021",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-457"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.opendesign.com/security-advisories",
      "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea"
    }
  ]
}