CVE-2025-43572

Executive Summary

CVE-2025-43572 is a high-severity out-of-bounds write vulnerability affecting Dassault Systèmes Dimension versions 4.1.2 and earlier. This flaw allows an attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. The vulnerability resides in the application's file parsing logic, where insufficient bounds checking on user-supplied data leads to a write operation beyond the allocated buffer. Successful exploitation could result in full system compromise, including data theft, installation of malware, or lateral movement within a network. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the lack of a confirmed patch elevates the risk for organizations using this software.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (Dassault Systèmes Dimension) and does not involve open-source package registries.

CVSS Breakdown & Threat Level

CVSS Score: 7.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or convince the user to open a file.
• Attack Complexity (AC): Low (L) – No special conditions are required; the vulnerability is easily exploitable.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full data access is possible.
• Integrity (I): High (H) – Full data modification is possible.
• Availability (A): High (H) – Full system denial of service or control is possible.

Threat Level: High. While no public exploit exists, the vulnerability is easy to exploit (low complexity) and requires only user interaction. The lack of a patch makes it a prime target for targeted attacks.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds write (CWE-787) in the file parsing engine of Dassault Systèmes Dimension. When the application processes a specially crafted file (e.g., a .3dxml or other supported format), it fails to validate the size of an input buffer before writing data to a fixed-size stack or heap buffer. This allows an attacker to overwrite adjacent memory regions, including function pointers, return addresses, or data structures.

Technical Flow:

1. The user opens a malicious file (e.g., via email attachment or download).
2. Dimension's parser reads the file and extracts a specific field (e.g., a string or numeric value).
3. The parser copies this field into a fixed-size buffer without checking the length.
4. If the field is larger than the buffer, the write operation overflows into adjacent memory.
5. The attacker can craft the overflow data to overwrite a return address or a function pointer, redirecting execution to shellcode embedded in the file.

Root Cause: Lack of bounds checking in the memcpy or strcpy equivalent function used during file parsing. The vulnerable code likely resembles:

char buffer[256];
memcpy(buffer, user_input, user_input_length); // No size check

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes for out-of-bounds write vulnerabilities.

Vulnerable Code (Dimension 4.1.2 and earlier):

void parse_field(char *input, size_t input_len) {
    char buffer[256];
    // No bounds check - vulnerable to overflow
    memcpy(buffer, input, input_len);
    // Process buffer...
}

Patched Code (Hypothetical fix):

void parse_field(char *input, size_t input_len) {
    char buffer[256];
    // Bounds check added
    if (input_len > sizeof(buffer)) {
        // Handle error, reject file
        return;
    }
    memcpy(buffer, input, input_len);
    // Process buffer...
}

The fix involves adding a length check before the memcpy operation to ensure the input does not exceed the buffer size.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Dassault Systèmes Dimension version 4.1.2 or earlier installed on a Windows target.
• A malicious file crafted to trigger the overflow.

Exploitation Steps:

1. Craft the Malicious File: Use a fuzzer or manual analysis to identify the vulnerable field. Create a file where that field contains a long string of data, including shellcode and a ROP chain to bypass DEP/ASLR.
2. Deliver the File: Send the file via email, a download link, or physical media.
3. Trigger the Vulnerability: Convince the victim to open the file in Dimension.
4. Gain Code Execution: The overflow overwrites a return address, redirecting execution to the shellcode. This grants a reverse shell or executes arbitrary commands.

Example Payload Structure (Hypothetical):

[File Header][Vulnerable Field: "A"*256 + ROP Chain + Shellcode][File Footer]

No public exploit code is available for this CVE.

Blue Team (Defensive)

Detection:

• Monitor for unusual file open operations involving Dimension.
• Use endpoint detection and response (EDR) to detect memory corruption events (e.g., access violations, DEP violations).
• Deploy YARA rules to scan for malicious files targeting Dimension.

Prevention:

• Restrict execution of Dimension to trusted users only.
• Use application whitelisting to prevent unknown binaries from running.
• Enable ASLR and DEP on all systems.
• Isolate critical systems from email and web browsing.

Indicators of Compromise (IOCs)

• File Hashes: (None available publicly; generate your own from known malicious samples)
• File Names: Suspicious .3dxml or .3d files with unusually large sizes or unexpected content.
• Process Behavior: Dimension.exe crashing with access violation errors (Event ID 1000 in Windows Application Log).
• Network Connections: Outbound connections from Dimension.exe to unknown IPs (if shellcode establishes a reverse shell).
• Registry Changes: Unauthorized modifications to HKEY_CURRENT_USER\Software\Dassault Systèmes\Dimension.

Detection Engineering

YARA Rule

rule CVE_2025_43572_Dimension_OOBW {
    meta:
        description = "Detects malicious files targeting CVE-2025-43572 in Dassault Systèmes Dimension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-43572"
    strings:
        $s1 = "3dxml" ascii wide nocase
        $s2 = { 00 00 00 00 } // Placeholder for specific pattern
        $s3 = /.{256,}/ // Long string indicative of overflow
    condition:
        $s1 and #s3 > 1 and filesize < 10MB
}

Sigma Rule

title: CVE-2025-43572 - Out-of-Bounds Write in Dassault Systèmes Dimension
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes or memory corruption events related to Dimension.exe
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Dimension.exe'
        CommandLine|contains: '.3dxml'
    condition: selection
falsepositives:
    - Legitimate large files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-43572 - Potential Dimension Exploit Outbound"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect systems running Dimension 4.1.2 or earlier from the network if possible.
2. Restrict File Access: Block execution of .3dxml and .3d files from untrusted sources via email gateways and web filters.
3. User Awareness: Train users not to open files from unknown senders.

Long-Term Fix:

• Monitor the vendor's website for a security patch. As of now, no patch is available.
• Consider migrating to an alternative 3D modeling tool if the risk is unacceptable.
• Implement application sandboxing (e.g., Windows Sandbox, Firejail) to contain exploitation.

Workaround:

• Use a file scanner that detects oversized fields in Dimension files (custom YARA rule above).

Valters IT
Securing Digital Frontiers