Read the docs
TI-2024-01719 Aliases CVE-2024-1847GHSA-fg22-qrcp-mch6

Heap-based buffer overflow in Dassault Systèmes eDrawings

Priority LOW 36CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, IPT, JT, SAT, STL, STP, X_B or X_T file. NOTE: CVE-2024-3298 and CVE-2024-3299 were SPLIT from this ID.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dassault SystèmeseDrawingsRelease SOLIDWORKS 2023 SP0 – Release SOLIDWORKS 2023 SP5; Release SOLIDWORKS 2024 SP0 – Release SOLIDWORKS 2024 SP1—No fix listedCNA
  • eDrawings VendorDassault Systèmes Affected Release SOLIDWORKS 2023 SP0 – Release SOLIDWORKS 2023 SP5; Release SOLIDWORKS 2024 SP0 – Release SOLIDWORKS 2024 SP1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:3ds:solidworks:*:*:*:*:*:*:*:*2023 to before 2024VulnerableDassault Systèmes
cpe:2.3:a:3ds:solidworks:2024:-:*:*:*:*:*:*2024VulnerableDassault Systèmes
cpe:2.3:a:3ds:solidworks:2024:sp1.0:*:*:*:*:*:*2024 sp1.0VulnerableDassault Systèmes
  • cpe:2.3:a:3ds:solidworks:*:*:*:*:*:*:*:* Versions 2023 to before 2024 Vulnerable ·Dassault Systèmes
  • cpe:2.3:a:3ds:solidworks:2024:-:*:*:*:*:*:* Versions 2024 Vulnerable ·Dassault Systèmes
  • cpe:2.3:a:3ds:solidworks:2024:sp1.0:*:*:*:*:*:* Versions 2024 sp1.0 Vulnerable ·Dassault Systèmes

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1847
  2. 2026-10-03 Alias added: GHSA-fg22-qrcp-mch6

References

Advisory 1

  • TI-2026-02995 Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences