Which versions of Siemens Solid Edge are affected by CVE-2026-50058?

A high-severity out-of-bounds read vulnerability in Siemens Solid Edge SE2025 and SE2026 enables code execution when engineers open specially crafted drawing files, creating direct risk to design and…

How to fix or mitigate CVE-2026-50058?

Within 24 hours, audit all Siemens Solid Edge SE2025 and SE2026 deployments across engineering and manufacturing teams, and advise users to avoid opening DFT files from untrusted external sources until patching is complete. Within 7 days, deploy SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7 to all affected systems, prioritizing engineering departments that handle externally sourced documents. By day 30, confirm patching completion across all instances, establish documented file-source verification procedures for incoming design files from external partners, and deliver targeted security awareness training to engineering staff on document-delivery threats.

Siemens Solid Edge CVE-2026-50058

Q: What is the CVSS score of CVE-2026-50058?

CVE-2026-50058 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-56110 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 siemens

GHSA-wvcm-ccqr-89r7

Buffer Overflow Information Disclosure Siemens Solid Edge Se2025 Solid Edge Se2026

7.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

User must open the crafted DFT file locally (AV:L, UI:R); no privileges required; successful parse-triggered code execution yields full C/I/A impact within the process.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 13:55 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 11, 2026 - 13:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 13:22 NVD

7.8 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 11, 2026 - 13:18 vuln.today

CVE Published

Aug 11, 2026 - 12:20 cve.org

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.

Technical ContextAI

The vulnerability is classified as CWE-125 (Out-of-Bounds Read) within the DFT file parser of Siemens Solid Edge, a professional 3D CAD/CAM application widely used in mechanical and industrial engineering. DFT files are Solid Edge 2D draft drawing files; parsing these files involves reading structured binary data, and a malformed DFT can cause the parser to read beyond the bounds of an allocated memory buffer. While CWE-125 is primarily a memory disclosure primitive, the CVSS 4.0 impact metrics of VC:H/VI:H/VA:H indicate the out-of-bounds read condition is exploitable for code execution within the current process - potentially by reading and manipulating control-flow structures, function pointers, or adjacent heap metadata. Tags from the intelligence feed reference both 'Information Disclosure' and 'Buffer Overflow,' the latter likely describing the exploitable consequence rather than the precise root-cause class. Affected CPEs are cpe:2.3:a:siemens:solid_edge_se2025:*:*:*:*:*:*:*:* and cpe:2.3:a:siemens:solid_edge_se2026:*:*:*:*:*:*:*:*, covering all pre-patch releases of each respective product line.

RemediationAI

Siemens has released patches that resolve this vulnerability: users of Solid Edge SE2025 should upgrade to V225.0 Update 15 or later, and users of Solid Edge SE2026 should upgrade to V226.0 Update 7 or later. Full patch details and download instructions are available in Siemens Product CERT advisory SSA-621657 at https://cert-portal.siemens.com/productcert/html/ssa-621657.html. For organizations unable to apply patches immediately, compensating controls include blocking inbound DFT files at email gateways and file-transfer checkpoints to prevent delivery of malicious files - note this may disrupt external design collaboration workflows. Additionally, enforcing application allowlisting and restricting Solid Edge execution to managed, controlled workstations reduces exposure. Users should be trained not to open DFT files from untrusted or unverified sources, though this control is inherently unreliable as a sole mitigation. Network segmentation of engineering workstations can limit the blast radius of a successful compromise.