A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition…
Priority LOW 36CWE-763Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing checks of user-supplied input data, when a malicious CGF file is imported to IGSS Definition.
Why it matters now
EPSS 0.01172 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | IGSS Definition (Def.exe) V15.0.0.21140 and prior | IGSS Definition (Def.exe) V15.0.0.21140 and prior | — | No fix listed | CNA |
- IGSS Definition (Def.exe) V15.0.0.21140 and prior Vendor— Affected IGSS Definition (Def.exe) V15.0.0.21140 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:interactive_graphical_scada_system:*:*:*:*:*:*:*:* | up to 15.0.0.21140 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:interactive_graphical_scada_system:*:*:*:*:*:*:*:* Versions up to 15.0.0.21140 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22760
- 2026-10-03 Alias added: GHSA-486p-jw3h-72gh
References
More Schneider Electric Interactive Graphical Scada System vulnerabilities
- TI-2013-00550 Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System… CVSS 2.0HIGH 10.0
- TI-2022-02151 Integer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
- TI-2022-14164 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
- TI-2022-14162 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
- TI-2022-14161 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
- TI-2022-14160 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-22760 · CVE Program
- CVE-2021-22760 · NVD
- FIRST EPSS
- GHSA-486p-jw3h-72gh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences