Read the docs
TI-2021-12602 Aliases CVE-2021-32994GHSA-f933-7c3x-46v4

Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer

Priority MEDIUM 42CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01694 77th percentileScored 2026-11-07
Fix Fixed OPC UA C++ SDK (Software Development Kit) (Softing): 5.64

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SoftingOPC UA C++ SDK (Software Development Kit)5.59 to before 5.645.64Patch availableCNA
  • OPC UA C++ SDK (Software Development Kit) VendorSofting Affected 5.59 to before 5.64 Fixed in 5.64 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:*:*:*:*:*:*:*:*5.59.0 to before 5.65.0VulnerableSofting
  • cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:*:*:*:*:*:*:*:* Versions 5.59.0 to before 5.65.0 Vulnerable ·Softing

Remediation

  • Fix · CNA OPC UA C++ SDK (Software Development Kit) (Softing) Fixed in 5.64

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32994
  2. 2026-10-03 Alias added: GHSA-f933-7c3x-46v4

References

Advisory 1

  • TI-2022-02157 Softing Secure Integration Server Improper Authentication CVSS 3.1CRITICAL 9.8
  • TI-2022-02155 Softing Secure Integration Server Uncontrolled Search Path Element CVSS 3.1HIGH 7.2
  • TI-2022-01254 Softing Secure Integration Server Relative Path Traversal CVSS 3.1HIGH 7.2
  • TI-2022-02353 Softing Secure Integration Server NULL Pointer Dereference CVSS 3.1HIGH 7.5
  • TI-2022-02158 Softing Secure Integration Server NULL Pointer Dereference CVSS 3.1HIGH 7.5
  • TI-2022-02156 Softing Secure Integration Server Integer Underflow CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences