CVE-2023-51746 is a stack overflow in Siemens JT2Go and Teamcenter Visualization that is triggered when the application parses a crafted CGM file. The record rates it High at 7.8. Siemens fixed it in JT2Go V14.3.0.6 and matching Teamcenter Visualization releases.
What's affected
The Siemens advisory lists these affected products and fixed versions:
- JT2Go, all versions before V14.3.0.6. Update to V14.3.0.6 or later.
- Teamcenter Visualization V13.3, all versions before V13.3.0.13. Update to V13.3.0.13 or later.
- Teamcenter Visualization V14.1, all versions before V14.1.0.12. Update to V14.1.0.12 or later.
- Teamcenter Visualization V14.2, all versions before V14.2.0.9. Update to V14.2.0.9 or later.
- Teamcenter Visualization V14.3, all versions before V14.3.0.6. Update to V14.3.0.6 or later.
The record gives a CVSS score of 7.8 (High). The CVSS vector reads as follows. The attack needs local access to the system, and the complexity is low. No account is needed. A user has to take some action, such as opening a file or following a link. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-121.
How to check if you're exposed
These are desktop applications, so check them on the machines where they are installed. On Windows, open Settings, then Apps, find JT2Go or Teamcenter Visualization, and read the version number. Compare it with the fixed version for your product line above.
If you manage software centrally, query your endpoint inventory for these two product names and list any installation below the fixed build. Pay particular attention to engineering workstations and shared review machines, where people open files received from suppliers.
What to do now
- Find every installation of JT2Go and Teamcenter Visualization.
- Update to the fixed version for your product line, as listed in the Siemens advisory.
- Until updated, treat CGM files from outside your organisation as untrusted and do not open them in the affected applications.
- Read the Workarounds and Mitigations section of the Siemens advisory for the product specific guidance.
- Add these applications to your regular patch cycle, since file viewers tend to be missed.
Why it matters
The applications contain a stack based buffer overflow in their CGM file parser. A specially crafted file can overwrite memory on the stack, which can crash the application or, according to Siemens and the record, allow code to run in the context of the current process.
Exploitation needs a person to open the file, which is why the vector says user interaction is required and the attack is local. That is a real constraint, but engineering teams routinely exchange drawings and models, and a file that arrives by email or from a supplier portal looks routine.
This CVE is a companion to CVE-2023-51745. Their records match word for word, so the fix is the same. Closing one ticket without the other is an easy mistake to make, so track both against the same update.
Quick check
Does the user have to open a file?
Yes. Both the record and the Siemens advisory describe the trigger as opening a crafted CGM file.
Which versions fix it?
JT2Go V14.3.0.6 and later, and Teamcenter Visualization V13.3.0.13, V14.1.0.12, V14.2.0.9 or V14.3.0.6 and later, depending on your line.
Sources
Last reviewed: 19 October 2026.
