CVE-2021-43391

An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file (an invalid dash counter in line types) can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

• CWE-125

• https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
• https://www.opendesign.com/security-advisoriesVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1352/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1361/Third Party Advisory, VDB Entry
• https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
• https://www.opendesign.com/security-advisoriesVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1352/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-1361/Third Party Advisory, VDB Entry

Published

Nov 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4337Sixteen XforWooCommerce Add-On Plugins for WordPress are vul…8.8
• CVE-2021-4338The 404 to 301 plugin for WordPress is vulnerable to authori…5.4
• CVE-2021-43388Unisys Cargo Mobile Application before 1.2.29 uses cleartext…7.5
• CVE-2021-43389An issue was discovered in the Linux kernel before 5.14.15. …5.5
• CVE-2021-4339The uListing plugin for WordPress is vulnerable to authoriza…5.3
• CVE-2021-43390An Out-of-Bounds Write vulnerability exists when reading a D…7.8
• CVE-2021-43392STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43393STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43394Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC…9.8
• CVE-2021-43395An issue was discovered in illumos before f859e7171bb5db3432…5.5
• CVE-2021-43396In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc…7.5
• CVE-2021-43397LiquidFiles before 3.6.3 allows remote attackers to elevate …8.8