CVE-2020-26986: 
Siemens JT2Go vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2020-26986) was identified in JT2Go (All versions < V13.1.0) and Teamcenter Visualization (All versions < V13.1.0). The vulnerability stems from improper validation of user-supplied data when parsing JT files (CISA, NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787). It has a CVSS v3.1 base score of 8.8 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue results from the lack of proper validation of user-supplied data length prior to copying it to a heap-based buffer (ZDI).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process, potentially leading to full system compromise with the privileges of the affected application (ZDI, CISA).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges but does need user interaction (ZDI).

Siemens has released updates to address this vulnerability. Users should update JT2Go and Teamcenter Visualization to version 13.1.0 or later. Additionally, organizations should limit the opening of untrusted files in systems where these applications are installed and apply defense-in-depth concepts (CISA).