The UCM procedure contains a security vulnerability when you use BY-group processing


Severity: High

Description: PROC UCM stops processing and either generates traceback information with an access violation or crashes SAS. This issue can occur when you specify a BY statement and when some BY groups contain poorly behaved data.

To circumvent this issue, run PROC UCM separately for each BY-group, as illustrated in SAS Note 66249, "RunBY macro: Add BY processing to macros, procedures, or special code."

Potential Impact: The resulting access violation introduces a potential security risk.