Read the docs
TI-2024-21519 Aliases CVE-2024-32637GHSA-x3j5-gf6q-9cm2

NULL pointer dereference in Siemens JT2Go

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed JT2Go (Siemens): V2312.0005Teamcenter Visualization V14.2 (Siemens): V14.2.0.12+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensJT2Gobefore V2312.0005V2312.0005Patch availableCNA
SiemensTeamcenter Visualization V14.2before V14.2.0.12V14.2.0.12Patch availableCNA
SiemensTeamcenter Visualization V14.3before V14.3.0.10V14.3.0.10Patch availableCNA
SiemensTeamcenter Visualization V2312before V2312.0005V2312.0005Patch availableCNA
  • JT2Go VendorSiemens Affected before V2312.0005 Fixed in V2312.0005 Patch available CNA
  • Teamcenter Visualization V14.2 VendorSiemens Affected before V14.2.0.12 Fixed in V14.2.0.12 Patch available CNA
  • Teamcenter Visualization V14.3 VendorSiemens Affected before V14.3.0.10 Fixed in V14.3.0.10 Patch available CNA
  • Teamcenter Visualization V2312 VendorSiemens Affected before V2312.0005 Fixed in V2312.0005 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*2312.0 to before 2312.0005VulnerableSiemens
cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*35.0 to before 35.1.256; 36.0 to before 36.0.208; 36.1 to before 36.1.173VulnerableSiemens
cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*14.2 to before 14.2.0.12; 14.3 to before 14.3.0.10; 2312.0 to before 2312.0005VulnerableSiemens
  • cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:* Versions 2312.0 to before 2312.0005 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* Versions 35.0 to before 35.1.256; 36.0 to before 36.0.208; 36.1 to before 36.1.173 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:* Versions 14.2 to before 14.2.0.12; 14.3 to before 14.3.0.10; 2312.0 to before 2312.0005 Vulnerable ·Siemens

Remediation

  • Fix · CNA JT2Go (Siemens) Fixed in V2312.0005
  • Fix · CNA Teamcenter Visualization V14.2 (Siemens) Fixed in V14.2.0.12
  • Fix · CNA Teamcenter Visualization V14.3 (Siemens) Fixed in V14.3.0.10
  • Fix · CNA Teamcenter Visualization V2312 (Siemens) Fixed in V2312.0005

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens JT2Go, Teamcenter Visualization V14.2 and 2 more products V14.2.0.12, V14.3.0.10, V2312.0005

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32637
  2. 2026-10-03 Alias added: GHSA-x3j5-gf6q-9cm2

References

Advisory 2

  • TI-2020-16414 NULL pointer dereference in Siemens JT2Go CVSS 3.1HIGH 8.8
  • TI-2020-16413 Type confusion in Siemens JT2Go CVSS 3.1HIGH 8.8
  • TI-2020-16410 Heap-based buffer overflow in Siemens JT2Go CVSS 3.1HIGH 8.8
  • TI-2020-16408 Heap-based buffer overflow in Siemens JT2Go CVSS 3.1HIGH 8.8
  • TI-2020-16419 Out-of-bounds read in Siemens JT2Go CVSS 3.1HIGH 8.8
  • TI-2020-16418 Out-of-bounds write in Siemens JT2Go CVSS 3.1HIGH 8.8
See all 165 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences