MathWorks Simulink EUVD-2026-91823

Exploitation requires a victim to open an attacker-crafted .slx Simulink model file in the Simulink Editor on a vulnerable release (any version before R2026b); the core enabling condition is Simulink's handling of block visibility in the .slx format, which lets specially crafted blocks be present and execute while never appearing in the Editor (CWE-451). Limiting factors are significant: the attack is local only (AV:L) with no network vector, mandatory user interaction is required (UI:R) to open the malicious file, attack complexity is High (AC:H), and there is no privilege requirement (PR:N) but also no automatability - it depends entirely on social engineering to get a target to open an untrusted model. Impact is bounded to the Low confidentiality and integrity rating because Simulink models already execute embedded code by design; the vulnerability adds concealment, not a new execution channel.

All signals point to a LOW real-world priority despite the alarming 'code execution' wording. The CVSS 3.1 base score is 3.6 (Low) and the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N is internally consistent with a social-engineering file-open attack: local vector, high attack complexity, mandatory user interaction, and only Low confidentiality/integrity impact with no availability impact. There is a notable tension between the 'RCE' tag plus the description phrase 'cause code execution' and the modest C:L/I:L/A:N impact - this is because Simulink models legitimately execute embedded MATLAB/callback code when opened, so the genuine flaw (CWE-451, UI misrepresentation) is the CONCEALMENT of malicious blocks from the Editor, not a new code-execution primitive; the low impact metrics reflect that marginal deception delta rather than classic unauthenticated RCE. No CISA KEV listing and no EPSS score were provided in the input, so exploitation-probability data is MISSING and cannot be cited. A third-party researcher disclosure write-up (alexanderboll.dev) is referenced, which likely contains technical detail, but the input provides no explicit POC/exploit-code flag, so weaponized exploit availability is unconfirmed. Net: this is a high-CVSS-term ('code execution') but genuinely low-real-risk issue whose main danger is to organizations that routinely open or share untrusted .slx model files.

An attacker crafts a malicious .slx Simulink model containing blocks that are rendered invisible in the Simulink Editor and distributes it to a target engineer (e.g., as a shared project, email attachment, or model from an untrusted collaborator). When the victim opens the file in a Simulink version before R2026b, the concealed blocks execute code without the user ever seeing them in the Editor, defeating visual review of the model. A researcher disclosure write-up is publicly referenced, but no confirmed weaponized exploit code is indicated in the input; the local vector and high complexity (AV:L/AC:H/UI:R) mean success depends on convincing the victim to open the crafted file.