Which versions of SolidCAM-GPPL-IDE are affected by CVE-2026-42212?

SolidCAM-GPPL-IDE versions 1.0.0-1.0.1 contain XML parsing vulnerabilities that enable attackers to crash services and potentially access sensitive files through maliciously crafted .gpp files.. A patch is available.

How to fix or mitigate CVE-2026-42212?

Within 24 hours, identify all instances of SolidCAM-GPPL-IDE 1.0.0-1.0.1 and notify users to avoid opening .gpp files from untrusted sources. Within 7 days, deploy version 1.0.2 to all affected systems. Within 30 days, verify complete migration to the patched version and enable endpoint monitoring to detect process crashes and unusual file-access patterns indicative of exploitation.

SolidCAM-GPPL-IDE CVE-2026-42212

Q: What is the CVSS score of CVE-2026-42212?

CVE-2026-42212 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28839 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-08 security-advisories@github.com

Denial Of Service

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Remote malicious file needs only victim to open it (UI:R), no auth (PR:N); primary confirmed impact is DoS (A:H), with C:L added for plausible XXE file disclosure and I:N as integrity is unaffected.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:36 vuln.today

Analysis Generated

Jul 23, 2026 - 22:36 vuln.today

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 22:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.

AnalysisAI

XML External Entity (XXE) and XML-bomb weaknesses in SolidCAM-GPPL-IDE (an unofficial third-party Postprocessor IDE extension for SolidCAM), versions 1.0.0 through 1.0.1, let an attacker weaponize a malicious companion .vmid file. When a victim opens an attacker-supplied foo.gpp file, the language server automatically parses foo.vmid from the same directory using XDocument.Load with .NET 8 default DTD processing enabled, allowing recursive entity expansion to exhaust memory and crash the service, and potentially external-entity local file references. Publicly available exploit code exists (SSVC: PoC); it is not in CISA KEV and EPSS is very low (0.04%), indicating no observed widespread exploitation. Patched in version 1.0.2.

Technical ContextAI

The root cause is CWE-400 (Uncontrolled Resource Consumption), manifested through unsafe XML parsing. GpplVmidParser.TryParse called XDocument.Load(path) with no XmlReaderSettings, so it inherited .NET 8's framework defaults which permit DTD processing and external entity resolution. This is the classic XXE / 'billion laughs' pattern: a Document Type Definition can declare nested entities that expand exponentially (memory exhaustion / DoS) or SYSTEM external entities that reference file:/// URIs or attacker URLs (information disclosure / out-of-band exfiltration). The .vmid files are shipped alongside third-party postprocessors and are therefore untrusted input, yet were parsed with full default trust. The fix hardens the reader with DtdProcessing=Prohibit, XmlResolver=null, MaxCharactersFromEntities=0, a 10 MB document cap, and a pre-read FileInfo.Length check. The affected product is a VS Code-style IDE extension with a bundled SolidCAM.GPPL.Server.exe language server; no CPE entries are provided.

RemediationAI

Vendor-released patch: upgrade to version 1.0.2, released 2026-04-20 (https://github.com/anzory/SolidCAM-GPPL-IDE/releases/tag/v1.0.2; fix commit 9d0ba808afd143ede448026a5dc681bfdc5c138d; changelog https://github.com/anzory/SolidCAM-GPPL-IDE/blob/master/CHANGELOG.md#102--2026-04-20). The patch configures the VMID XmlReader with DtdProcessing=Prohibit, XmlResolver=null, MaxCharactersFromEntities=0 and a 10 MB size cap, and also removes unsafe path handling in inc directives. If immediate patching is not possible, do not open .gpp files from untrusted or externally sourced postprocessor packages, and manually inspect or delete any companion .vmid file (matching the foo.gpp/foo.vmid naming convention) before opening a .gpp - the trade-off is that legitimate postprocessors relying on their .vmid metadata will not render fully. Host-level egress filtering and blocking outbound SMB (TCP 445) and unexpected HTTP from the workstation running the IDE reduce out-of-band XXE exfiltration and related NTLM-leak risk, at the cost of tightening network policy on developer machines.