CVE-2025-10021

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-22 · updated 2026-10-23
Weakness: CWE-457

Description

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior, memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.

Affected products

Open Design Alliance ODA Drawings SDK - All Versions < 2026.12: before 2026.12 — fixed in 2026.12

How to fix

Upgrade to a fixed version: Open Design Alliance ODA Drawings SDK - All Versions < 2026.12 2026.12. Check the vendor advisory for mitigations.

References

https://www.opendesign.com/security-advisories

Get alerted when CVE-2025-10021 or the next vulnerability affects your stack