CVE-2026-22923: Siemens NX PDF Export RCE Vulnerability

CVE-2026-22923 Overview

A data validation vulnerability has been identified in Siemens NX, a widely-used computer-aided design (CAD) software suite. The vulnerability exists in the PDF export functionality and could allow an attacker with local access to interfere with internal data processing, potentially leading to arbitrary code execution. This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), indicating improper handling of data boundaries during the export operation.

Critical Impact

Local attackers can exploit the PDF export process in Siemens NX to achieve arbitrary code execution through stack-based buffer overflow, potentially compromising engineering workstations and sensitive design data.

Affected Products

• Siemens NX (All versions prior to V2512)

Discovery Timeline

• 2026-02-10 - CVE-2026-22923 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-22923

Vulnerability Analysis

This vulnerability stems from insufficient data validation during the PDF export process in Siemens NX. When a user initiates a PDF export operation, the application fails to properly validate internal data boundaries, creating an opportunity for stack-based buffer overflow. The CWE-121 classification indicates that the vulnerability allows writing beyond the bounds of a stack-allocated buffer, which can corrupt adjacent memory including return addresses and saved registers.

The attack requires local access to the system and some user interaction (such as opening a malicious file or triggering the export function). Despite these prerequisites, successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system. Engineering workstations running NX often contain sensitive intellectual property and design files, making this a high-value target for attackers.

Root Cause

The root cause is a stack-based buffer overflow (CWE-121) in the data validation routines of the PDF export functionality. The application allocates a fixed-size buffer on the stack to process export data but fails to verify that incoming data fits within these boundaries. When oversized or malformed data is processed, it overwrites adjacent stack memory, potentially allowing an attacker to redirect program execution.

Attack Vector

The attack vector is local, requiring an attacker to have access to the system running Siemens NX. The exploitation scenario typically involves:

1. An attacker crafts a malicious NX project file or manipulates the export process
2. The victim opens the file or initiates a PDF export operation
3. During the export process, the malicious data triggers the buffer overflow
4. The overflow corrupts stack memory, allowing the attacker to control program execution
5. Arbitrary code is executed with the privileges of the NX application user

The vulnerability requires user interaction to trigger the vulnerable code path, but no privileges are required beyond local system access. For detailed technical information, refer to the Siemens Security Advisory SSA-535115.

Detection Methods for CVE-2026-22923

Indicators of Compromise

• Unexpected crashes or abnormal termination of the NX application during PDF export operations
• Unusual process behavior or child processes spawned by the NX executable
• Anomalous memory access patterns or access violation errors in application logs
• Suspicious file access or network connections originating from the NX process

Detection Strategies

• Monitor for stack buffer overflow indicators using endpoint detection tools with memory protection capabilities
• Implement application whitelisting to detect unauthorized code execution from NX process context
• Deploy file integrity monitoring on NX installation directories
• Configure logging to capture PDF export operations and associated errors

Monitoring Recommendations

• Enable detailed application logging for Siemens NX export functions
• Monitor system event logs for application crashes involving ugraf.exe or related NX processes
• Implement SentinelOne Singularity for real-time behavioral analysis of CAD application processes
• Review any unexpected modifications to NX configuration or temporary files

How to Mitigate CVE-2026-22923

Immediate Actions Required

• Upgrade Siemens NX to version V2512 or later immediately
• Restrict local access to engineering workstations running NX to authorized personnel only
• Avoid opening NX project files from untrusted sources until patched
• Implement network segmentation to isolate CAD workstations from general network traffic

Patch Information

Siemens has addressed this vulnerability in NX version V2512. Organizations should prioritize upgrading to this version or later to remediate the vulnerability. For detailed patch information and download instructions, refer to the Siemens Security Advisory SSA-535115.

Workarounds

• Disable or restrict PDF export functionality if not immediately required for business operations
• Implement strict file validation procedures for any NX project files before opening
• Run NX in a sandboxed or virtualized environment to limit the impact of potential exploitation
• Apply principle of least privilege to user accounts running NX applications