CVE-2017-20211 UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE
Attacker can execute arbitrary code via crafted input to the RotateShape method in the E-XD++ ActiveX control, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-20211?
CVE-2017-20211 is a high-severity vulnerability in UCanCode.Net Software E-XD++ Visualization Enterprise Suite, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file).
Weakness: CWE-823
Which versions are affected by CVE-2017-20211?
How do I fix CVE-2017-20211?
No fix has been published for CVE-2017-20211 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-20211 being exploited?
There is no known exploitation of CVE-2017-20211 in the wild and no public exploit code.
Sources
Also known as GHSA-q7vh-44j8-j22p.