Solidworks Desktop CVE-2026-3476

SOLIDWORKS Desktop Release 2025 or 2026 installed and configured to open crafted file formats. User interaction required: victim must open the malicious file. No authentication bypass needed.

The CVSS 7.8 score indicates high severity, but real-world risk is moderated by several factors. The local attack vector (AV:L) and required user interaction (UI:R) significantly limit exploitation scalability compared to remote vulnerabilities. With no privileges required (PR:N) and low attack complexity (AC:L), successful exploitation is straightforward once a user is tricked into opening a malicious file. The absence of KEV listing indicates no known active exploitation, and without EPSS data or public POCs, the immediate threat level appears theoretical rather than imminent. This represents a priority for organizations using SOLIDWORKS but not an emergency compared to actively exploited vulnerabilities.

An attacker crafts a malicious SOLIDWORKS file containing embedded code and distributes it via email phishing or compromised file sharing platforms targeting engineering firms. When an unsuspecting engineer opens the file in SOLIDWORKS Desktop 2025 or 2026, the embedded code executes with the user's privileges, potentially installing malware, exfiltrating sensitive CAD designs, or establishing persistence for further attacks. The attack requires convincing social engineering since direct user action is needed to open the file.