CVE-2020-26980: siemens jt2go Type Confusion

Vulnerability summary

CVE-2020-26980 is a high (CVSS 8.8) Type Confusion vulnerability in siemens jt2go. EPSS estimates a 3.17% chance of exploitation in the next 30 days, higher than 87.9% of scored vulnerabilities.

Timeline

1. 12-01-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing JT files. A crafted JT file could trigger a type confusion condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11881)

• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.