Stack-based buffer overflow in Siemens JT Open
Priority LOW 35CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150). The affected application contains a stack overflow vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Fix Fixed JT Open (Siemens): V11.2.3.0JT Utilities (Siemens): V13.2.3.0+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | JT Open | before V11.2.3.0 | V11.2.3.0 | Patch available | CNA |
| Siemens | JT Utilities | before V13.2.3.0 | V13.2.3.0 | Patch available | CNA |
| Siemens | Parasolid V34.0 | before V34.0.252 | V34.0.252 | Patch available | CNA |
| Siemens | Parasolid V34.1 | before V34.1.242 | V34.1.242 | Patch available | CNA |
| Siemens | Parasolid V35.0 | before V35.0.170 | V35.0.170 | Patch available | CNA |
| Siemens | Parasolid V35.1 | before V35.1.150 | V35.1.150 | Patch available | CNA |
- JT Open VendorSiemens Affected before V11.2.3.0 Fixed in V11.2.3.0 Patch available CNA
- JT Utilities VendorSiemens Affected before V13.2.3.0 Fixed in V13.2.3.0 Patch available CNA
- Parasolid V34.0 VendorSiemens Affected before V34.0.252 Fixed in V34.0.252 Patch available CNA
- Parasolid V34.1 VendorSiemens Affected before V34.1.242 Fixed in V34.1.242 Patch available CNA
- Parasolid V35.0 VendorSiemens Affected before V35.0.170 Fixed in V35.0.170 Patch available CNA
- Parasolid V35.1 VendorSiemens Affected before V35.1.150 Fixed in V35.1.150 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:* | before 11.2.3.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:* | before 11.2.3.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* | 34.0 to before 34.0.252; 34.1 to before 34.1.242; 35.0 to before 35.0.170; 35.1 to before 35.1.150 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:* Versions before 11.2.3.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:* Versions before 11.2.3.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* Versions 34.0 to before 34.0.252; 34.1 to before 34.1.242; 35.0 to before 35.0.170; 35.1 to before 35.1.150 Vulnerable ·Siemens
Remediation
- Fix · CNA JT Open (Siemens) Fixed in V11.2.3.0
- Fix · CNA JT Utilities (Siemens) Fixed in V13.2.3.0
- Fix · CNA Parasolid V34.0 (Siemens) Fixed in V34.0.252
- Fix · CNA Parasolid V34.1 (Siemens) Fixed in V34.1.242
- Fix · CNA Parasolid V35.0 (Siemens) Fixed in V35.0.170
- Fix · CNA Parasolid V35.1 (Siemens) Fixed in V35.1.150
Timeline
- 2026-10-02 Threatist record created from CVE-2022-47936
- 2026-10-03 Alias added: GHSA-jwxr-mm9c-284w
References
More Siemens Jt Open Toolkit vulnerabilities
- TI-2021-19766 Use after free in Siemens JT Open CVSS 3.1HIGH 7.8
- TI-2021-19754 Out-of-bounds write in Siemens JT Open CVSS 3.1HIGH 7.8
- TI-2022-23749 Memory corruption in Siemens JT Open CVSS 3.1HIGH 7.8
- TI-2022-20204 A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap… CVSS 3.1HIGH 7.8
- TI-2021-20063 Out-of-bounds write in Siemens JT Utilities CVSS 3.1HIGH 7.8
- TI-2021-20061 Use after free in Siemens JT Utilities CVSS 3.1HIGH 7.8
Sources
- CVE-2022-47936 · CVE Program
- CVE-2022-47936 · NVD
- FIRST EPSS
- GHSA-jwxr-mm9c-284w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences