CVE-2025-10021

The record

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior,  memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.

Affected packages

Related vulnerabilities

• CVE-2026-112898 Pillow is a Python imaging library. CWE-457
• CVE-2026-112893 Pillow is a Python imaging library. CWE-457
• CVE-2026-109828 A vulnerability was found in libsndfile up to 1.2.2. CWE-457
• CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through… CWE-457
• CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized memory to… CWE-457
• CVE-2026-78935 Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65… CWE-457
• CVE-2026-62986 OpenEXR is the reference implementation and specification for the EXR image file format… CWE-457
• CVE-2026-76919 ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of… CWE-457