CVE-2020-26986: Siemens JT2Go JT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of JT files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12014)
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26986?
CVE-2020-26986 has been classified as a critical severity vulnerability due to its potential to cause a heap-based buffer overflow.
How do I fix CVE-2020-26986?
To fix CVE-2020-26986, upgrade to Siemens JT2Go or Teamcenter Visualization version 13.1.0 or later.
What types of attacks can exploit CVE-2020-26986?
CVE-2020-26986 can be exploited through specially crafted JT files that manipulate user-supplied data during parsing.
Which products are affected by CVE-2020-26986?
CVE-2020-26986 affects all versions of Siemens JT2Go and Teamcenter Visualization that are older than version 13.1.0.
Is CVE-2020-26986 found in any other applications?
CVE-2020-26986 is specifically identified in Siemens JT2Go and Teamcenter Visualization products.