CVE-2022-29032: 
Siemens JT2Go vulnerability analysis and mitigation

A double free vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), and Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The vulnerability exists in the CGM_NIST_Loader.dll library while parsing specially crafted CGM files. This vulnerability was assigned CVE-2022-29032 and was disclosed in May 2022 (CISA Advisory).

The vulnerability is classified as CWE-415 (Double Free) and received a CVSS v3.1 Base Score of 7.8 HIGH with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically affects the CGM_NIST_Loader.dll library's handling of CGM file parsing operations (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected systems (CISA Advisory).

The vulnerability requires local access and user interaction, as indicated by the CVSS metrics (AV:L/AC:L/PR:N/UI:R). An attacker would need to trick a user into opening a specially crafted malicious CGM file with the affected products to exploit this vulnerability (NVD).

Siemens has released updates to address this vulnerability. Users should update to JT2GO v13.3.0.3, Teamcenter Visualization v13.3.0.3, or Teamcenter Visualization v14.0.0.1 as appropriate. As a workaround, users should avoid opening untrusted files from unknown sources in affected products (CISA Advisory).