ODA Drawings SDK CVE-2025-10021

Exploitation is limited to applications that link the affected Open Design Alliance Drawings SDK static multithreaded ('mt') builds prior to version 2026.12 and that instantiate the global COdaMfcAppApp theApp object; the crash is triggered deterministically during static-object construction at process startup when OdString::kEmpty is accessed before initialization. Limiting factors: the attack vector is local (AV:L) - not remotely reachable - so an attacker must already be able to run or influence the launch of the vulnerable application; dynamically-linked SDK builds and versions 2026.12 and later are not affected. The impact is reliably a startup denial of service; any escalation to memory corruption or code execution is undefined-behavior-dependent and unproven.

This is a moderate-severity reliability defect that presents as a denial-of-service risk rather than a high-priority exploitation target. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:N, VA:H, VI:L, VC:N) scores 7.0 and is consistent with the description: a local, low-complexity flaw whose primary impact is availability (startup crash) with only low integrity impact and no confidentiality impact. Multiple low-risk signals align: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit was identified. The flaw is a Static Initialization Order Fiasco (CWE-457, use of uninitialized variable) - a deterministic startup crash, not a remotely reachable memory-corruption primitive. The description's claim that 'memory corruption and potential arbitrary code execution cannot be ruled out' is explicitly speculative and is NOT supported by any POC or exploitation evidence; it should not be treated as confirmed RCE. Note a signal conflict: the input Tags assert 'RCE' and 'Buffer Overflow,' but the underlying weakness (CWE-457, uninitialized static variable) is neither a buffer overflow nor a demonstrated code-execution bug - verify before escalating. Also note the local attack vector (AV:L) means this is not remotely exploitable despite PR:N; practical risk is confined to environments running vulnerable static (mt) SDK builds.

An application built against the affected Open Design Alliance Drawings SDK static (mt) library loads and, during C++ static-object construction, the global COdaMfcAppApp theApp accesses OdString::kEmpty before it is initialized, reading uninitialized memory and crashing the process on startup. No public exploit exists; the realistic outcome is a reproducible denial of service, with theoretical memory-corruption consequences that remain unverified.