CVE-2020-26995: 
Siemens JT2Go vulnerability analysis and mitigation

CVE-2020-26995 is a vulnerability identified in JT2Go (All versions < V13.1.0) and Teamcenter Visualization (All versions < V13.1.0). The vulnerability was disclosed in January 2021 and affects applications that lack proper validation of user-supplied data when parsing SGI and RGB files (NVD, ZDI-21-060).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) that can result in a write operation past the end of an allocated structure. The issue stems from improper validation of user-supplied data during the parsing of SGI and RGB files. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 HIGH with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system with high severity ratings across all three aspects (ZDI-21-060).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no special privileges for exploitation (ZDI-21-060, ZDI-21-241).

Siemens has released version 13.1.0 of both JT2Go and Teamcenter Visualization to address this vulnerability. Users are advised to update to these versions or later to mitigate the risk (NVD).