Siemens Solid Edge CVE-2026-50061

The victim must actively open a specially crafted DFT file using an affected version of Siemens Solid Edge SE2025 (all versions before V225.0 Update 15) or SE2026 (all versions before V226.0 Update 7) on their local workstation. The CVSS 4.0 AC:H metric confirms that reliably triggering the use-after-free requires a precisely constructed file - crafting a working exploit is non-trivial and demands knowledge of Solid Edge's heap layout and DFT format internals. Passive exposure to the file (e.g., a file appearing in a directory listing) is insufficient; the application must parse the file. No system-level privileges are required on the target host, but the attacker must successfully deliver the malicious DFT file and persuade the user to open it, limiting exploitation to social engineering or supply-chain scenarios. The flaw is local in scope - remote unauthenticated network exploitation is not possible.

The CVSS 4.0 score of 7.3 with AV:L and AC:H meaningfully constrains the real-world attack surface relative to network-exploitable flaws. Exploitation requires local delivery of a malicious DFT file and passive user interaction (the victim must open it), ruling out unauthenticated remote or automated mass-exploitation scenarios. The AC:H metric reflects the non-trivial expertise required to craft a reliably triggering DFT payload for a UAF class bug. The VC:H/VI:H/VA:H impact triad is accurate - successful exploitation yields full code execution in the Solid Edge process. There is no CISA KEV listing and no public proof-of-concept referenced in available data, placing current exploitation probability in the low tier; EPSS data was not supplied and cannot be evaluated. The realistic threat model is targeted social engineering against engineers - delivery of a malicious DFT file via email, project collaboration platforms, or a compromised shared drive. Generic opportunistic exploitation is unlikely given the file-open prerequisite and high attack complexity.

An attacker with knowledge of the Solid Edge DFT binary format crafts a malicious DFT file that triggers the use-after-free condition during parsing, then delivers it to a target mechanical engineer via spear-phishing email or a compromised shared project repository. When the engineer opens the file in an unpatched Solid Edge instance, the corrupted heap state redirects execution to attacker-controlled code running as the engineer's Windows user account. No public proof-of-concept is known at time of analysis, suggesting current practical exploitation is limited to threat actors with reverse engineering expertise and access to Solid Edge internals.