Siemens Solid Edge Plagued by Multiple File Parsing Vulnerabilities
Siemens Solid Edge is affected by seven critical file parsing vulnerabilities that could allow attackers to crash the application or execute arbitrary code.
Siemens has issued a security advisory detailing multiple critical vulnerabilities within its Solid Edge software, a widely used product for product design, simulation, and manufacturing.
The vulnerabilities, collectively cataloged under CVE-2026-50058 through CVE-2026-50064, stem from flaws in how Solid Edge parses specific file formats: PAR, PSM, and DFT. These formats are integral to the software's functionality, handling various aspects of 3D design and data management.
Exploitation of these vulnerabilities could lead to severe consequences for users. The flaws include out-of-bounds read and write errors, as well as use-after-free conditions. An attacker could leverage these weaknesses by tricking a user into opening a specially crafted malicious file. Successful exploitation could result in the application crashing, leading to a denial-of-service condition, or, more critically, allow for arbitrary code execution within the context of the affected user's process.
The affected versions of Siemens Solid Edge are SE2025 prior to version V225.0.15 and SE2026 prior to version V226.0.7. These versions are susceptible to a range of attacks, with specific vulnerabilities targeting different file types. For instance, CVE-2026-50058 and CVE-2026-50062 are out-of-bounds read vulnerabilities affecting DFT and PAR files respectively, while CVE-2026-50064 is an out-of-bounds write vulnerability in PSM files. Several use-after-free vulnerabilities (CVE-2026-50060 and CVE-2026-50061) also exist within DFT file parsing.
Siemens has acknowledged the severity of these issues and has released updated versions of Solid Edge to address them. Users are strongly advised to update their installations to the latest available versions to mitigate the risks associated with these vulnerabilities. The company provides detailed information and download links for the patched versions on its support portal.
The Common Vulnerabilities and Exposures (CVE) system has assigned high severity ratings to these vulnerabilities, with CVSS v3.1 base scores of 7.8. The attack vector is typically local (AV:L), requiring no special privileges (PR:N), but necessitates user interaction (UI:R) through the opening of a malicious file. The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H).
These vulnerabilities highlight a persistent challenge in software development, particularly within complex engineering applications like CAD/CAM software. The intricate nature of file parsing and data handling presents numerous opportunities for memory corruption bugs, which attackers can exploit for code execution. The widespread use of Siemens products in critical infrastructure sectors, such as critical manufacturing, underscores the importance of timely patching and robust security practices.
Organizations utilizing Siemens Solid Edge are urged to prioritize the application of security updates. Proactive vulnerability management, including regular software updates and user awareness training regarding suspicious file handling, is crucial to defending against potential exploitation of these and similar weaknesses.