The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocation structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
| Software | From | Fixed in |
|---|---|---|
| siemens / solid_edge_se2020_firmware | - | 2020mp14 |
| siemens / solid_edge_se2021_firmware | - | se2021mp5 |