CVE-2021-27592

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
SAP SE	SAP 3D Visual Enterprise Viewer	< 9

References

https://launchpad.support.sap.com/#/notes/3027767Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-311/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-313/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-314/Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/3027767Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-311/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-313/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-314/Third Party Advisory, VDB Entry

Timeline

Published: Mar 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-275933.3When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, t CVE-2021-275943.3When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applicatio CVE-2021-275953.3When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the CVE-2021-275963.3When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer,CVE-2021-275977.5SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.CVE-2021-275985.3SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data l CVE-2021-275996.5SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, CVE-2021-276005.4SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HT CVE-2021-276015.4SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the serve CVE-2021-276029.9SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which a CVE-2021-276036.5An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for an CVE-2021-276046.5In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Servi