Read the docs
TI-2021-18273 Aliases CVE-2021-41534GHSA-64h2-jvjq-j585

Out-of-bounds read in Siemens NX 1980 Series

Priority LOW 18CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process (ZDI-CAN-13703).

Why it matters now

EPSS 0.00966 61st percentileScored 2026-11-07
Fix Fixed NX 1980 Series (Siemens): V1984

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensNX 1980 Seriesbefore V1984V1984Patch availableCNA
SiemensSolid Edge SE2021All versions < SE2021MP8—No fix listedCNA
  • NX 1980 Series VendorSiemens Affected before V1984 Fixed in V1984 Patch available CNA
  • Solid Edge SE2021 VendorSiemens Affected All versions < SE2021MP8 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*before se2021VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*se2021VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*se2021 maintenance_pack1VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*se2021 maintenance_pack2VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*se2021 maintenance_pack3VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*se2021 maintenance_pack4VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5:*:*:*:*:*:*se2021 maintenance_pack5VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6:*:*:*:*:*:*se2021 maintenance_pack6VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7:*:*:*:*:*:*se2021 maintenance_pack7VulnerableSiemens
cpe:2.3:o:siemens:nx_1984_firmware:*:*:*:*:*:*:*:*before 1984VulnerableSiemens
  • cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:* Versions before se2021 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:* Versions se2021 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:* Versions se2021 maintenance_pack1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:* Versions se2021 maintenance_pack2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:* Versions se2021 maintenance_pack3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:* Versions se2021 maintenance_pack4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5:*:*:*:*:*:* Versions se2021 maintenance_pack5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6:*:*:*:*:*:* Versions se2021 maintenance_pack6 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7:*:*:*:*:*:* Versions se2021 maintenance_pack7 Vulnerable ·Siemens
  • cpe:2.3:o:siemens:nx_1984_firmware:*:*:*:*:*:*:*:* Versions before 1984 Vulnerable ·Siemens
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:siemens:nx_1984:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:nx_1988_firmware:*:*:*:*:*:*:*:*before 1984VulnerableSiemens
cpe:2.3:h:siemens:nx_1988:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:h:siemens:nx_1984:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:nx_1988_firmware:*:*:*:*:*:*:*:* Versions before 1984 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:nx_1988:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA NX 1980 Series (Siemens) Fixed in V1984

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41534
  2. 2026-10-03 Alias added: GHSA-64h2-jvjq-j585

References

Patch 2

Advisory 1

  • TI-2021-18274 Use after free in Siemens NX 1953 Series CVSS 3.1HIGH 7.8
  • TI-2021-18277 A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX… CVSS 3.1LOW 3.3
  • TI-2021-18272 Out-of-bounds read in Siemens NX 1980 Series CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences