CVE-2021-44002: siemens jt_open Out-of-bounds Write

Vulnerability summary

CVE-2021-44002 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in siemens jt_open. EPSS estimates a 1.62% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities.

Timeline

1. 14-12-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058, ZDI-CAN-19076, ZDI-CAN-19077)

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.