CVE-2017-20211CWE-823

UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE

High · published November 12, 2025

CVSS v4.0
8.6
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file).

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00794 · 55.9th percentile
Weakness
CWE-823 · Use of Out-of-range Pointer Offset
Published
2025-11-12T22:05Z
EPSS history
Timeline
  • 12 NOV 22:05Z
    UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE
    cvelistv5