ICSA-26-202-06: Siemens CADRA

CISA's summary

Summary: CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2005-2096 — CVE-2005-2096 · CWE-20

  zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

• CVE-2016-9840 — CVE-2016-9840 · CWE-20

  inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

• CVE-2016-9841 — CVE-2016-9841 · CWE-20

  inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

• CVE-2016-9842 — CVE-2016-9842 · CWE-1335

  The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

• CVE-2017-14919 — CVE-2017-14919 · CWE-20

  Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.

• CVE-2018-25032 — CVE-2018-25032 · CWE-787

  zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

• CVE-2022-37434 — CVE-2022-37434 · CWE-120

  zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

• CVE-2023-45853 — CVE-2023-45853 · CWE-190

  MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

• CVE-2025-10585 — CVE-2025-10585 · CWE-843

  Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• CVE-2025-13223 — CVE-2025-13223 · CWE-843

  Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• CVE-2026-22184 — CVE-2026-22184 · CWE-787

  zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

Acknowledgments, as the advisory lists them

• Siemens ProductCERT: reported these vulnerabilities to CISA.

The advisory's legal notice

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.