Siemens Solid Edge Multiple File Parsing Vulnerabilities (PAR/PSM/DFT)
First seen Aug 17, 2026 · Updated Aug 17, 2026 · CVSS 7.8
Siemens Solid Edge SE2025 and SE2026 contain seven high-severity memory corruption vulnerabilities (CVSS 7.8) triggered when parsing specially crafted PAR, PSM, or DFT files, which could allow an attacker to crash the application or achieve arbitrary code execution in the context of the current process. Exploitation requires a user to open a malicious file, making this a local-vector, user-interaction-required threat rather than a remotely exploitable one. Siemens has released patched versions (SE2025 V225.0.15+ and SE2026 V226.0.7+) and organizations should update promptly.
Technical Analysis
The advisory covers seven CVEs (CVE-2026-50058 through CVE-2026-50064) affecting Siemens Solid Edge CAD software, comprising out-of-bounds read (CWE-125), out-of-bounds write (CWE-787), and use-after-free (CWE-416) flaws in the parsers for DFT, PAR, and PSM file formats. All vulnerabilities share a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requiring local access and user interaction (opening a malicious file) but yielding high impact to confidentiality, integrity, and availability upon successful exploitation. These are classic file-format memory corruption bugs typical of engineering/CAD software, exploitable via socially engineered file delivery (e.g., email attachment or shared design file) rather than network-based attack. There is no direct AI agent impact identified, as Solid Edge is engineering/CAD software with no documented role in LLM tool use, RAG pipelines, or agent frameworks, though any organization using AI-driven design automation agents that programmatically open or process Solid Edge files (PAR/PSM/DFT) could inherit code-execution risk if such agents ingest untrusted files.
Affected Systems
Siemens Solid Edge SE2025 versions prior to V225.0.15; Siemens Solid Edge SE2026 versions prior to V226.0.7
Indicators of Compromise
- No specific IOCs published (vulnerability advisory, not an active exploitation campaign); malicious indicators would take the form of crafted .par, .psm, or .dft files
Remediation Steps
- 1
Update Solid Edge SE2025
Update to Solid Edge SE2025 V225.0 Update 15 or later via Siemens support portal.
- 2
Update Solid Edge SE2026
Update to Solid Edge SE2026 V226.0 Update 7 or later via Siemens support portal.
- 3
Restrict untrusted file handling
Avoid opening PAR, PSM, or DFT files from untrusted or unverified sources until patches are applied.
- 4
Network segmentation
Isolate engineering workstations running Solid Edge from business and internet-facing networks, per Siemens and CISA ICS guidance.
- 5
Apply defense-in-depth
Use firewalls, VPNs with up-to-date patching, and minimize direct internet exposure for control system and engineering environments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.