CVE-2021-32994— Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer
Quick assessment
Affected
Softing OPC UA C++ SDK (Software Development Kit)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Softing OPC UA C++ SDK是德国Softing公司的一个开发包。用于快速轻松地集成 OPC UA 客户端和服务器。 Softing OPC-UA C++ SDK 存在缓冲区错误漏洞，该漏洞源于导出的库函数没有正确验证接收到的扩展对象。该漏洞允许攻击者通过发送各种特制的数据包来访问多个意外的内存位置来使软件崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-32994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer
Source: CVE Program / CVE List V5
Vulnerability Description
Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Softing OPC UA C++ SDK 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Softing OPC UA C++ SDK是德国Softing公司的一个开发包。用于快速轻松地集成 OPC UA 客户端和服务器。 Softing OPC-UA C++ SDK 存在缓冲区错误漏洞，该漏洞源于导出的库函数没有正确验证接收到的扩展对象。该漏洞允许攻击者通过发送各种特制的数据包来访问多个意外的内存位置来使软件崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Softing | OPC UA C++ SDK (Software Development Kit) | 5.59 ~ 5.64 | - |
|
II. Public POCs for CVE-2021-32994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-32994
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-32994 (1)
-
https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: Softing
-
CVE-2023-7339
Data collection for dowloading leads into buffer overflow -
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or -
CVE-2025-13406
Scanning for higher HART revision device leads into NULL poi -
CVE-2025-10461
Global file reads caused by improper URL checks in webserver -
CVE-2025-10685
HTTP POST with specific higher content length leads into hea
Same weakness: CWE-119
-
CVE-2026-79069
Chrome 152.0.7977.65前Tint内存损坏漏洞 -
CVE-2022-50999
Nokogiri before 1.13.5 Integer Overflow via libxml2 -
CVE-2021-47996
Nokogiri before 1.11.4 Multiple Vulnerabilities via libxml2 -
CVE-2026-55586
SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX -
CVE-2026-18294
OriginLab Origin Viewer OGW File Parsing Memory Corruption R
V. Comments for CVE-2021-32994
No comments yet