Siemens Solid Edge CVE-2026-50059

The victim must open a specially crafted DFT (Solid Edge Draft) file using an unpatched version of Solid Edge SE2025 (before V225.0 Update 15) or SE2026 (before V226.0 Update 7) on a system where the application is locally installed. User interaction is required (UI:P in CVSS 4.0 / UI:R in CVSS 3.1 terms) - the user must actively open the malicious file. No special application configuration or elevated privilege is required by the attacker (PR:N), but success is limited by high attack complexity (AC:H), meaning reliably controlling the memory corruption to achieve arbitrary code execution is non-trivial. Exploitation is bounded to the current user's process context; no scope change to other system components is inherent. The attack does not work remotely without the user opening the file.

The CVSS 4.0 score of 7.3 with vector AV:L/AC:H/AT:N/PR:N/UI:P reflects a locally-triggered, user-interaction-dependent file-parsing flaw with high complexity, consistent with the need to craft a precisely malformed DFT file that reliably corrupts memory and redirects execution. The high C/I/A impact on the vulnerable system is realistic for a successful OOB write yielding code execution. AC:H is significant: reliable exploitation likely requires overcoming heap layout assumptions or mitigations such as ASLR/DEP, raising the bar for commodity attackers. No EPSS score was provided in the input. The product is not listed in CISA KEV and no public exploit or POC has been identified, making opportunistic mass exploitation unlikely at this time. The primary risk vector is targeted spear-phishing or supply-chain distribution of malicious DFT files to engineers in manufacturing environments. The scope is limited to the process context (S:U in 3.1 terms / SC:N in 4.0), so privilege escalation beyond the logged-in user is not inherent to this CVE.

An attacker crafts a malformed DFT draft file with a field value that triggers the out-of-bounds write in Solid Edge's parser, then delivers it to a target engineer via email, a shared project repository, or a compromised collaboration platform. When the victim opens the file in an unpatched version of Solid Edge SE2025 or SE2026, the parser writes beyond the allocated buffer, enabling the attacker to gain code execution within the Solid Edge process context. No public POC has been identified at time of analysis, and AC:H suggests reliable exploitation requires non-trivial memory layout control.