CVE-2024-26277
Reported by siemens · Published April 9, 2024
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Teamcenter Visualization V2312 | Siemens | 2312.0004 |
| Teamcenter Visualization V14.2 | Siemens | 14.2.0.12 |
| Parasolid V35.1 | Siemens | 35.1.254 |
| Teamcenter Visualization V14.3 | Siemens | 14.3.0.9 |
| JT2Go | Siemens | 2312.0004 |
| Parasolid V36.1 | Siemens | 36.1.147 |
| Parasolid V36.0 | Siemens | 36.0.207 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | JT2Go | 0 |
| Siemens | Parasolid V35.1 | 0 |
| Siemens | Parasolid V36.0 | 0 |
| Siemens | Parasolid V36.1 | 0 |
| Siemens | Teamcenter Visualization V14.2 | 0 |
| Siemens | Teamcenter Visualization V14.3 | 0 |
| Siemens | Teamcenter Visualization V2312 | 0 |
| Siemens | Teamcenter Visualization V2312 | 0 |
| Siemens | Teamcenter Visualization V14.2 | 0 |
| Siemens | Parasolid V35.1 | 0 |
| Siemens | Teamcenter Visualization V14.3 | 0 |
| Siemens | JT2Go | 0 |
| Siemens | Parasolid V36.1 | 0 |
| Siemens | Parasolid V36.0 | 0 |
Timeline
- Apr 9, 2024 CVE Published
- Apr 10, 2024 EPSS Score (30 in total, the first dated here)
- Aug 13, 2024 CVE Updated
- Oct 4, 2024 Coalition ESS Score (5 in total, the first dated here)
- Jun 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-26277
vulnetix vdb fixes CVE-2024-26277Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-26277/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart