CVE-2022-40658 - This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0

Back Back to CVE browser

HIGH

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0

Published Sep 15, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.81%

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15166.

Affected products

Vendor Nikon Product NIS-Elements Viewer Default
n/a
- Version
  1.2100.1483.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nikon

NIS-Elements Viewer

n/a

Version	Status	Constraints
1.2100.1483.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43930
Advisory
https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html
Product
https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1214/
x_refsource_MISCThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43930		Advisory
https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html		Product
https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf		Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1214/		x_refsource_MISCThird Party AdvisoryVDB Entry