CVE-2023-2763

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-416 CWE-787

Affected software

Vendor	Product	Versions
Dassault Systèmes	SOLIDWORKS Desktop	>= Release SOLIDWORKS 2021 Golden, <= Release SOLIDWORKS 2021 SP5.1; >= Release SOLIDWORKS 2022 Golden, <= Release SOLIDWORKS 2022 SP5; >= Release SOLIDWORKS 2023 Golden, <= Release SOLIDWORKS 2023 SP2

References

https://www.3ds.com/vulnerability/advisoriesVendor Advisory
https://www.3ds.com/vulnerability/advisoriesVendor Advisory

Timeline

Published: Jul 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-276305.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepS CVE-2023-276315.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions.CVE-2023-276328.8Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.03.08 versions.CVE-2023-276338.8Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.CVE-2023-276348.8Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versions.CVE-2023-276357.8debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (Th CVE-2023-276365.4Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.CVE-2023-276379.8An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged w CVE-2023-276389.8An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged w CVE-2023-276397.5An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged w CVE-2023-27644.3The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set CVE-2023-276407.5An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged w