CVE-2021-38405

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
Siemens	JT2Go	< 13.2.0.7
Siemens	Teamcenter Visualization	>= 12.4, < 12.4.0.13; >= 13.1, < 13.1.0.8; >= 13.2, < 13.2.0.7; >= 13.3, < 13.3.0.1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdfVendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07Third Party Advisory, US Government Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdfVendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07Third Party Advisory, US Government Resource

Timeline

Published: Nov 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384067.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th CVE-2021-384074.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi CVE-2021-384089.8A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the leng CVE-2021-384097.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an access of uninitialized pointer, which may al CVE-2021-38415.4sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vuln CVE-2021-384107.8AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an unco CVE-2021-384114.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi CVE-2021-384129.8Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not req CVE-2021-384137.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow a CVE-2021-384157.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a special CVE-2021-384167.8Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeov CVE-2021-384177.5VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user v