CVE-2025-10021

State: Published
Severity: 7.0 High
Published: Dec 22, 2025
Updated: Dec 22, 2025
Reserved: Sep 5, 2025

Description

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior, memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Amber	ODA

Weaknesses

CWE-457 Use of Uninitialized Variable

Affected Products

Product	Versions
ODA Drawings SDK - All Versions < 2026.12Open Design Alliance	before 2026.12Affected

References

https://www.opendesign.com/security-advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.