Which versions of Siemens Solid Edge are affected by CVE-2026-50063?

Siemens Solid Edge SE2025 and SE2026 contain a memory corruption vulnerability in the PAR file parser that enables arbitrary code execution when users open malicious document files.

How to fix or mitigate CVE-2026-50063?

Within 24 hours, identify all Solid Edge SE2025 and SE2026 installations across the organization and enforce file controls restricting PAR file execution from untrusted sources; notify engineering teams to avoid opening unsolicited CAD files and report suspicious document delivery. Within 7 days, obtain the Siemens vendor patches for SE2025 and SE2026, validate them in a test environment, and stage them in your change-management pipeline with priority routing to workstations that frequently receive external design files. Within 30 days, complete patch deployment to all affected instances and conduct follow-up security training for design teams emphasizing file-based social engineering risks.

Siemens Solid Edge CVE-2026-50063

Q: What is the CVSS score of CVE-2026-50063?

CVE-2026-50063 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-56115 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 siemens

GHSA-c6h6-v4ff-46h4

Buffer Overflow Information Disclosure Siemens Solid Edge Se2025 Solid Edge Se2026

7.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local delivery via malicious file (AV:L), user must open it (UI:R), high complexity for reliable heap exploitation (AC:H), no privileges needed, full process impact.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 13:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 11, 2026 - 13:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 13:22 NVD

7.8 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 11, 2026 - 13:14 vuln.today

CVE Published

Aug 11, 2026 - 12:20 cve.org

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.

Technical ContextAI

Siemens Solid Edge is a professional 3D CAD/CAM/CAE application used in manufacturing and product design. The PAR file format is Solid Edge's native part-file format, parsed by a dedicated internal library. The root cause is CWE-125 (Out-of-Bounds Read): when processing a malformed PAR file, the parser reads beyond the allocated buffer boundary, corrupting adjacent memory. Depending on heap layout, this can be leveraged for controlled code execution within the process. Affected CPEs are cpe:2.3:a:siemens:solid_edge_se2025 (all versions before V225.0 Update 15) and cpe:2.3:a:siemens:solid_edge_se2026 (all versions before V226.0 Update 7). The tags 'Information Disclosure' and 'Buffer Overflow' suggest the read primitive can also leak sensitive in-process memory before escalating to execution.

RemediationAI

Upgrade Solid Edge SE2025 to V225.0 Update 15 or later, and Solid Edge SE2026 to V226.0 Update 7 or later; these are vendor-confirmed patched versions per Siemens advisory SSA-621657 (https://cert-portal.siemens.com/productcert/html/ssa-621657.html). As a compensating control where immediate patching is not possible, restrict the opening of PAR files received from untrusted external sources by enforcing file-type filtering at email gateways and web proxies, and educate users to refuse unsolicited CAD files. Isolating Solid Edge workstations from internet-facing file transfer paths reduces the delivery surface. Note that these controls do not eliminate risk if attackers already have access to shared internal file repositories. No workaround eliminates the underlying parser flaw - patching is the only definitive fix.