Vulnerability Spotlight: Multiple vulnerabilities in ACD Systems Canvas Draw 5
Summary: Cisco Talos disclosed four out-of-bounds write vulnerabilities in ACD Systems Canvas Draw 5, confirmed in version 5.0.0.28, found in the parsing of TIFF, PCX and CALS Raster image files. Each is triggered by a specially crafted image and can overwrite arbitrary data, letting an attacker gain code execution; Talos worked with ACD Systems on an update and published Snort rules 39593-39596, 39599-39632, 47336 and 47337 to detect exploitation attempts.
Bottom line: The delivery mechanism is an ordinary image file - TIFF and PCX are routine in graphic design and fax distribution - so the malicious payload arrives in a format recipients are conditioned not to question.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-3973CVE-2018-3976CVE-2018-3980CVE-2018-3981
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026