TI-2022-23749 Aliases CVE-2022-47935 GHSA-4hw2-gmf2-pgm8

Memory corruption in Siemens JT Open

LOW 36CWE-119Published 2023-01-10 · Updated 2025-04-08

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a memory corruption vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19078)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0029 21st percentileScored 2026-11-07

Fix Fixed JT Open (Siemens): V11.1.1.0JT Utilities (Siemens): V13.1.1.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	JT Open	before V11.1.1.0	V11.1.1.0	Patch available	CNA
Siemens	JT Utilities	before V13.1.1.0	V13.1.1.0	Patch available	CNA
Siemens	Solid Edge	before V2023	V2023	Patch available	CNA

JT Open VendorSiemens Affected before V11.1.1.0 Fixed in V11.1.1.0 Patch available CNA
JT Utilities VendorSiemens Affected before V13.1.1.0 Fixed in V13.1.1.0 Patch available CNA
Solid Edge VendorSiemens Affected before V2023 Fixed in V2023 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:jt_open_toolkit::::::::	before 11.1.1.0	Vulnerable	Siemens
cpe:2.3:a:siemens:jt_utilities::::::::	before 13.1.1.0	Vulnerable	Siemens
cpe:2.3:a:siemens:solid_edge::::::::	before se2023	Vulnerable	Siemens

cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:* Versions before 11.1.1.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:* Versions before 13.1.1.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:* Versions before se2023 Vulnerable ·Siemens

Remediation

Fix · CNA JT Open (Siemens) Fixed in V11.1.1.0
Fix · CNA JT Utilities (Siemens) Fixed in V13.1.1.0
Fix · CNA Solid Edge (Siemens) Fixed in V2023

Timeline

2026-10-02 Threatist record created from CVE-2022-47935
2026-10-03 Alias added: GHSA-4hw2-gmf2-pgm8

References

Patch 1

https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf

TI-2021-19766 Use after free in Siemens JT Open CVSS 3.1HIGH 7.8
TI-2021-19754 Out-of-bounds write in Siemens JT Open CVSS 3.1HIGH 7.8
TI-2022-20204 A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap… CVSS 3.1HIGH 7.8
TI-2021-20063 Out-of-bounds write in Siemens JT Utilities CVSS 3.1HIGH 7.8
TI-2021-20061 Use after free in Siemens JT Utilities CVSS 3.1HIGH 7.8
TI-2021-20060 Out-of-bounds write in Siemens JT Utilities CVSS 3.1HIGH 7.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences