Siemens Solid Edge
Plan PatchCVSS 7.8ICS-CERT ICSA-26-134-03May 12, 2026
Siemens
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Solid Edge SE2026 versions before Update 5 contain two file parsing vulnerabilities (CWE-824: Uninitialized Variable, CWE-121: Stack-based Buffer Overflow) in the PAR file format parser. An attacker can trigger these by crafting a malicious PAR file that causes memory corruption, resulting in application crash or arbitrary code execution when opened by a user. The vulnerability is present in SE2026 versions prior to 226.0 Update 5.
What this means
What could happen
An attacker could crash Solid Edge or execute arbitrary code on an engineering workstation by sending a specially crafted PAR file. This affects design and analysis workflows but requires user interaction to open the malicious file.
Who's at risk
Engineering and design teams using Solid Edge SE2026 on workstations for CAD design, 3D modeling, and product analysis. This includes automotive, machinery, and equipment manufacturers who rely on Solid Edge for design workflows.
How it could be exploited
An attacker creates a malicious PAR (Solid Edge part/assembly file) with crafted file parsing structures and distributes it to users. When an engineer opens the file in Solid Edge, the application parses the corrupted data, triggering a buffer overflow or memory corruption, leading to application crash or code execution.
Prerequisites
- User must open a malicious PAR file in Solid Edge SE2026
- Attacker must deliver the crafted file to the engineering workstation (email, file share, or supply chain)
low complexity attack (file parsing)user interaction requiredaffects engineering workstationsbuffer overflow vulnerability
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Solid Edge SE2026
HOTFIXUpdate Solid Edge SE2026 to version 226.0 Update 5 or later
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e0486684-a8aa-47f7-8aa5-b3a4c178a154Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.