CVE-2026-24497 is a critical (CVSS 9.8) stack based buffer overflow in SimTech Systems ThinkWise, versions 7 through 23, that can allow remote code execution. KrCERT lists version 23 as the resolved version. Update to the latest ThinkWise 23 build from the vendor.
What's affected
NVD says ThinkWise from 7 through 23 is affected. The Korean KrCERT advisory is a little more precise: it lists versions from 7 up to but not including 23 as affected and 23 as the resolved version, and tells users to check the vendor's patch notice and update. KrCERT scores it 8.4 High, against NVD's 9.8.
The vendor's patch notice for ThinkWise 23 Build #9333 says it addressed a document security vulnerability following a KISA recommendation, and removed an import feature for legacy map files, specifically files from ThinkWise 2.5 and earlier, with the .map extension. Later builds exist, so take the newest.
How to check if you're exposed
Open ThinkWise and check the version and build in the About dialog. If you manage desktops centrally, query installed versions with your software inventory tool.
Anything older than ThinkWise 23, or ThinkWise 23 on an older build than the vendor's current one, should be updated. Pay attention to shared machines, since people open map files received by email.
What to do now
- Update ThinkWise to the newest ThinkWise 23 build from the vendor's patch page.
- Avoid opening map files from senders you do not know until you have updated.
- Remove old copies of ThinkWise 7 through 22 you no longer need.
- Include ThinkWise in your software inventory so updates are visible.
Why it matters
The record lists CWE-121, stack based buffer overflow, and CWE-787, out-of-bounds write. A program copies more data into a fixed size buffer on the stack than it can hold, and the extra data overwrites neighboring memory, which can be steered to run attacker code.
The vendor notice connects the fix to document handling, and the removed import feature suggests file parsing is where the exposure lies. Desktop software that opens shared documents is a common route into an organization. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Which version fixes it?
KrCERT lists ThinkWise 23 as the resolved version. The vendor notice for Build #9333 addresses it, and later builds exist.
Why do NVD and KrCERT scores differ?
They score the same flaw with different CVSS assessments, 9.8 and 8.4. Both treat it as serious.
Sources
Last reviewed: 19 October 2026.
