Datalogics Library APDFL Stack-based Buffer Overflow
Priority LOW 36CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed JT2Go (Siemens ): 14.2.0.2Teamcenter Visualization (Siemens ): 13.2.0.13, 13.3.0.9, 14.0.0.5 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | JT2Go | before 14.2.0.2 | 14.2.0.2 | Patch available | CNA |
| Siemens | Teamcenter Visualization | 13.2 to before 13.2.0.13; 13.3 to before 13.3.0.9; 14.0 to before 14.0.0.5; 14.1 to before 14.1.0.7; 14.2 to before 14.2.0.2 | 13.2.0.13, 13.3.0.9, 14.0.0.5, 14.1.0.7, 14.2.0.2 | Patch available | CNA |
| Datalogics | Library APDFL | up to v18.0.4PlusP1e | — | No fix listed | CNA |
- JT2Go VendorSiemens Affected before 14.2.0.2 Fixed in 14.2.0.2 Patch available CNA
- Teamcenter Visualization VendorSiemens Affected 13.2 to before 13.2.0.13; 13.3 to before 13.3.0.9; 14.0 to before 14.0.0.5; 14.1 to before 14.1.0.7; 14.2 to before 14.2.0.2 Fixed in 13.2.0.13, 13.3.0.9, 14.0.0.5, 14.1.0.7, 14.2.0.2 Patch available CNA
- Library APDFL VendorDatalogics Affected up to v18.0.4PlusP1e Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:* | before 14.2.0.2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:* | 13.2.0 to before 13.2.0.13; 13.3.0 to before 13.3.0.9; 14.0 to before 14.0.0.5; 14.1 to before 14.1.0.7; 14.2 to before 14.2.0.2 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:* Versions before 14.2.0.2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:* Versions 13.2.0 to before 13.2.0.13; 13.3.0 to before 13.3.0.9; 14.0 to before 14.0.0.5; 14.1 to before 14.1.0.7; 14.2 to before 14.2.0.2 Vulnerable ·Siemens
Remediation
- Fix · CNA JT2Go (Siemens ) Fixed in 14.2.0.2
- Fix · CNA Teamcenter Visualization (Siemens ) Fixed in 13.2.0.13, 13.3.0.9, 14.0.0.5, 14.1.0.7, 14.2.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1709
- 2026-10-03 Alias added: GHSA-hfx6-59cf-wmqp
References
More Siemens Jt2go vulnerabilities
- TI-2020-16414 NULL pointer dereference in Siemens JT2Go CVSS 3.1HIGH 8.8
- TI-2020-16413 Type confusion in Siemens JT2Go CVSS 3.1HIGH 8.8
- TI-2020-16410 Heap-based buffer overflow in Siemens JT2Go CVSS 3.1HIGH 8.8
- TI-2020-16408 Heap-based buffer overflow in Siemens JT2Go CVSS 3.1HIGH 8.8
- TI-2020-16419 Out-of-bounds read in Siemens JT2Go CVSS 3.1HIGH 8.8
- TI-2020-16418 Out-of-bounds write in Siemens JT2Go CVSS 3.1HIGH 8.8
Sources
- CVE-2023-1709 · CVE Program
- CVE-2023-1709 · NVD
- FIRST EPSS
- GHSA-hfx6-59cf-wmqp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences