CVE-2025-10021_CVE-2025-10021

7 / 10

HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Amber

Description

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior, memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.

Basic Information

ID CVE-2025-10021

Source ODA

Published Dec 22, 2025 at 15:48

Modified Dec 22, 2025 at 16:07

Affected Product

Vendor Open Design Alliance

Product ODA Drawings SDK - All Versions < 2026.12

Affected Versions Open Design Alliance ODA Drawings SDK - All Versions < 2026.12 0

CWE Classification

CWE-457

References

www.opendesign.com /security-advisories

{
    "lastseen": "",
    "description": "A Use of Uninitialized Variable vulnerability exists in Open Design\u00a0Alliance Drawings SDK static versions (mt) before 2026.12. Static object\u00a0`COdaMfcAppApp theApp` may access `OdString::kEmpty` before its\u00a0initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior,\u00a0 memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.",
    "published": "2025-12-22T15:48:07.288Z",
    "modified": "2025-12-22T16:07:59.129Z",
    "type": "cve",
    "title": "CVE-2025-10021",
    "source": "ODA",
    "references": "https://www.opendesign.com/security-advisories",
    "id": "CVE-2025-10021",
    "bulletinFamily": "",
    "cwe": [
        "CWE-457"
    ],
    "cvelist": null,
    "sourceData": "Open Design Alliance ODA Drawings SDK - All Versions < 2026.12 0",
    "sourceHref": "",
    "cvss": {
        "score": 7,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Amber",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "ODA Drawings SDK - All Versions < 2026.12",
    "version": "0",
    "vendor": "Open Design Alliance",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}