3DEXPERIENCE Station Launcher CVE-2025-9976

Exploitation requires the victim to run the 3DEXPERIENCE Station Launcher App (releases R2022x through R2025x) and to interact with attacker-supplied input (UI:R) - most plausibly a crafted link, file, or protocol-handler invocation that the launcher processes. Code executes locally on the victim's machine with that user's privileges, not on a central server. Limiting factors: mandatory user interaction, dependence on the specific launcher client being installed and in the affected release range, and per the vendor an authenticated/logged-in context (PR:L). It is not a server-side, zero-click, or fully unauthenticated remote compromise.

The CVSS 3.1 base score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) is driven by the scope change and full CIA impact, but several signals temper the real-world urgency. This is a CLIENT-SIDE OS command injection: the description explicitly states code executes 'on the user's machine' via the Station Launcher App (a desktop/client component), not on a central server. Exploitation is gated by UI:R (the victim must interact - e.g. open a crafted link or file) and by the network-borne delivery of a malicious payload to that client. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - so this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. There is also mild internal tension worth noting: AV:N combined with 'execute arbitrary code on the user's machine' and UI:R strongly implies a crafted-link/URI-handler delivery model rather than direct remote server compromise; the PR:L choice (authenticated) is plausible if the launcher requires an active platform session, but the description does not itself confirm attacker privileges - verify auth prerequisites with the Dassault Systèmes advisory. Net: a legitimately high-severity RCE primitive, but user-interaction-gated and client-side, so it is a patch-soon priority rather than an emergency mass-exploitation threat absent any exploitation signal.

An attacker crafts a malicious link, file, or protocol-handler payload targeting the 3DEXPERIENCE Station Launcher App and delivers it to a user (phishing, malicious webpage, or shared document). When the victim opens/interacts with it, unsanitized input is passed to an OS command context, executing attacker-chosen commands with the user's privileges. No public exploit code is identified at time of analysis.