CVE-2021-44432: siemens jt_open_toolkit Stack-based Buffer Overflow

Vulnerability summary

CVE-2021-44432 is a high (CVSS 7.8) Stack-based Buffer Overflow vulnerability in siemens jt_open_toolkit. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities.

Timeline

1. 14-12-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to stack based buffer overflow while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14845)

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).