Read the docs
TI-2022-20204 Aliases CVE-2022-41851GHSA-4xcw-w9g9-vg97

A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap…

Priority LOW 36CWE-824Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-824 and the CVSS impact.

Summary

A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The JTTK library is vulnerable to an uninitialized pointer reference vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-16973)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix Fixed JTTK (Siemens): V11.1.1.0Simcenter Femap V2022.1 (Siemens): V2022.1.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensJTTKbefore V11.1.1.0V11.1.1.0Patch availableCNA
SiemensSimcenter Femap V2022.1before V2022.1.3V2022.1.3Patch availableCNA
SiemensSimcenter Femap V2022.2before V2022.2.2V2022.2.2Patch availableCNA
  • JTTK VendorSiemens Affected before V11.1.1.0 Fixed in V11.1.1.0 Patch available CNA
  • Simcenter Femap V2022.1 VendorSiemens Affected before V2022.1.3 Fixed in V2022.1.3 Patch available CNA
  • Simcenter Femap V2022.2 VendorSiemens Affected before V2022.2.2 Fixed in V2022.2.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:*before 11.1.1.0VulnerableSiemens
cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*2022.1.0 to before 2022.1.3; 2022.2.0 to before 2022.2.2VulnerableSiemens
  • cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:* Versions before 11.1.1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* Versions 2022.1.0 to before 2022.1.3; 2022.2.0 to before 2022.2.2 Vulnerable ·Siemens

Remediation

  • Fix · CNA JTTK (Siemens) Fixed in V11.1.1.0
  • Fix · CNA Simcenter Femap V2022.1 (Siemens) Fixed in V2022.1.3
  • Fix · CNA Simcenter Femap V2022.2 (Siemens) Fixed in V2022.2.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41851
  2. 2026-10-03 Alias added: GHSA-4xcw-w9g9-vg97

References

Patch 1

  • TI-2021-19766 Use after free in Siemens JT Open CVSS 3.1HIGH 7.8
  • TI-2021-19754 Out-of-bounds write in Siemens JT Open CVSS 3.1HIGH 7.8
  • TI-2022-23749 Memory corruption in Siemens JT Open CVSS 3.1HIGH 7.8
  • TI-2021-20063 Out-of-bounds write in Siemens JT Utilities CVSS 3.1HIGH 7.8
  • TI-2021-20061 Use after free in Siemens JT Utilities CVSS 3.1HIGH 7.8
  • TI-2021-20060 Out-of-bounds write in Siemens JT Utilities CVSS 3.1HIGH 7.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences