Siemens NX

A user opening a malicious PRT file in NX could crash the application or, in a worst case, allow an attacker to run code on the engineering workstation with the privileges of the user who opened the file.

Engineering teams and CAD operators who use NX (including student versions) are affected. NX is a design and manufacturing software tool; the risk is primarily to the engineering workstations where NX runs, not to production control systems directly. However, if an engineer's workstation is compromised, it could be used as a stepping stone to access the broader network or introduce malicious designs into manufacturing processes.

An attacker sends a malicious PRT (part) file to a user or places it on a file share. When the user opens the file in NX, the out-of-bounds read is triggered, causing either a denial of service (crash) or potentially arbitrary code execution on the workstation. This requires user interaction—the file must be opened deliberately.