CVE-2020-26993: 
Siemens JT2Go vulnerability analysis and mitigation

CVE-2020-26993 is a stack-based buffer overflow vulnerability affecting JT2Go (All versions < V13.1.0) and Teamcenter Visualization (All versions < V13.1.0). The vulnerability was discovered in 2020 and disclosed on January 12, 2021. The affected applications lack proper validation of user-supplied data when parsing CGM files, which could lead to a stack-based buffer overflow while trying to copy to a buffer in the font index handling function (CISA, MITRE).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) with a CVSS v3 base score of 7.8. The CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating local access, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability (CISA).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The high CVSS score indicates severe potential impacts on system confidentiality, integrity, and availability (CISA).

The vulnerability requires local access and user interaction to exploit. It has a low attack complexity, meaning it is relatively straightforward to exploit once the conditions are met. No special privileges are required to execute the attack (CISA).

Siemens recommends updating JT2Go to v13.1.0 or later and Teamcenter Visualization to v13.1.0 or later. Additional mitigation strategies include limiting the opening of untrusted files in systems where these applications are installed and applying a defense-in-depth concept to reduce the probability of untrusted code execution (CISA).