Siemens Solid Edge CVE-2026-50058

Exploitation requires the victim to actively open a specially crafted DFT file using an unpatched version of Siemens Solid Edge SE2025 (prior to V225.0 Update 15) or SE2026 (prior to V226.0 Update 7) on their local workstation. The CVSS 4.0 vector specifies UI:P (user interaction required) and AV:L (local attack vector), meaning the attacker must first deliver the malicious DFT file to the victim's system - via phishing, shared drives, USB media, or supply-chain document exchange - and then induce the user to open it within Solid Edge. The high attack complexity (AC:H) indicates successful escalation from the out-of-bounds read to reliable code execution may depend on specific memory layout or heap state conditions at runtime, introducing some probability of exploitation failure. No elevated privileges are required to trigger the vulnerability. The flaw is confined entirely to the file-parsing code path: it does not affect network-facing services, does not trigger on file enumeration alone, and requires Solid Edge to be the application handling the DFT file.

The CVSS 4.0 score of 7.3 appropriately reflects a local, user-interaction-dependent, high-complexity exploit path (AV:L/AC:H/UI:P), moderating what would otherwise be a critical outcome given full C/I/A impact on the vulnerable system. EPSS data was not supplied in the available intelligence, and the vulnerability is absent from the CISA KEV catalog, meaning no confirmed widespread or automated exploitation has been observed. The attack model - delivering a malicious CAD file to an engineer - maps directly to known industrial espionage tradecraft, where spear-phishing or supply-chain document poisoning is used to compromise design workstations; even a mid-sized municipal infrastructure team in olsztyn whose engineers routinely exchange DFT files with external contractors faces a realistic threat vector despite the local attack surface. The absence of a network-exposed attack path limits the blast radius compared to server-side vulnerabilities, but the full code-execution impact within a privileged engineering environment - where intellectual property, design schematics, and process documentation reside - elevates the business risk materially beyond the raw numeric score.

An attacker targeting an engineering organization crafts a malicious DFT file with a malformed structure designed to trigger an out-of-bounds read in Solid Edge's file parser, then delivers it to a target engineer via a phishing email, shared project repository, or a compromised supplier's document exchange. When the victim opens the file in an unpatched version of Solid Edge SE2025 or SE2026, the parser processes the malformed data, reads beyond the buffer boundary, and the resulting memory corruption leads to code execution within the Solid Edge process context. No public exploit code has been identified at time of analysis, though the technique class is well-documented for industrial CAD file parsers.