CVE-2022-41851

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-11 · updated 2026-06-17
Weakness: CWE-824

Description

A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The JTTK library is vulnerable to an uninitialized pointer reference vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-16973)

Affected products

Siemens Jt Open Toolkit: before 11.1.1.0 — fixed in 11.1.1.0
Siemens Simcenter Femap: from 2022.1.0 before 2022.1.3; from 2022.2.0 before 2022.2.2 — fixed in 2022.1.3, 2022.2.2

How to fix

Upgrade to a fixed version: Siemens Jt Open Toolkit 11.1.1.0; Siemens Simcenter Femap 2022.1.3, 2022.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-41851 or the next vulnerability affects your stack