CVE-2026-50058: Siemens Solid Edge out-of-bounds read in DFT file parsing

CVE-2026-50058 · Severity: high · CVSS 7.8 · Published 2026-08-11

Solid Edge is a professional 3D design and manufacturing software suite used by engineers and product development teams. The application fails to properly validate memory boundaries when processing specially crafted DFT design files, allowing an attacker to crash the application or execute arbitrary code with the privileges of the user running Solid Edge. An attacker could embed malicious DFT files in design projects or email attachments to compromise a designer's workstation.

Technologies: Siemens Solid Edge SE2026. Vendors: Siemens.

Quick answers

Is CVE-2026-50058 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50058 being exploited in the wild.
How severe is CVE-2026-50058?
High severity, with a CVSS score of 7.8, published 11 August 2026.
Which products and versions are affected?
Siemens Solid Edge SE2026 All versions < V226.0 Update 7; Siemens Solid Edge Se2025 All versions < V225.0 Update 15.
Is there a fix for CVE-2026-50058?
A patch was published on 2026-08-11: SE2025 update to V225.0 Update 15; SE2026 update to V226.0 Update 7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50058 attacked?
It is attacked with local access.
Am I affected by CVE-2026-50058?
Check whether you run Siemens Solid Edge SE2026 or Siemens Solid Edge Se2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-50058 is an out-of-bounds read vulnerability (CWE-125) triggered during DFT file parsing in Solid Edge SE2025 and SE2026. The vulnerability requires user interaction—an attacker must trick a user into opening a specially crafted DFT file—and operates with local attack vector since the file must be processed by the client application. Successful exploitation allows arbitrary code execution in the context of the Solid Edge process. Patches are available: SE2025 requires update to V225.0 Update 15 or later, and SE2026 requires update to V226.0 Update 7 or later.

Affected products

  • Siemens Solid Edge SE2025 All versions < V225.0 Update 15
  • Siemens Solid Edge SE2026 All versions < V226.0 Update 7

Timeline

  • 2026-08-11: disclosed
  • 2026-08-11: patched: SE2025 update to V225.0 Update 15; SE2026 update to V226.0 Update 7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.