Siemens Solid Edge Patches Seven File-Parsing RCEs
Seven file-parsing bugs, all 7.8, spanning three CAD formats, the patch is clean, but the format spread says the parsers weren't hardened as a group.
TL;DR
Siemens patched seven vulnerabilities in Solid Edge's file-parsing engine, all allowing remote code execution at CVSS 7.8 when a user opens a crafted file. Solid Edge SE2025 needs V225.0.15; SE2026 needs V226.0.7. The local attack vector requires user interaction, but CAD workflows routinely exchange files across organizations, opening a malicious file isn't the rare event the CVSS vector assumes.
The seven vulnerabilities (CVE-2026-50058 through CVE-2026-50064) are a mix of out-of-bounds reads, out-of-bounds writes, and use-after-free bugs. Each carries the same CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That's local attack, low complexity, no privileges required, but a victim does have to open a malicious file. The bugs live in Solid Edge's DFT, PAR, and PSM format handlers.
The format spread is the part worth noticing. DFT handles drafting. PAR manages part archives. PSM covers simulation models. All three parsers yielded the same class of memory-corruption bugs, which is the kind of distribution you get from a fuzzing campaign hitting multiple code paths in a shared parsing architecture, not from an isolated researcher finding one bug. Siemens ProductCERT reported these to CISA themselves, meaning internal discovery rather than external disclosure.
For the practitioner, the remediation is straightforward: Solid Edge SE2025 users update to V225.0 Update 15; SE2026 users update to V226.0 Update 7. Both are available through Siemens' support portal. The harder part is the operational one, Solid Edge files move between organizations in design-review workflows, and "don't open untrusted CAD files" isn't a control most engineering teams enforce with any rigor. The local attack vector puts the burden on the workstation rather than the network perimeter, which is exactly where most OT-adjacent engineering environments are weakest.
Published ·Updated ·Deep Fathom