CVE-2026-50059: Siemens Solid Edge out-of-bounds write in DFT file parsing

CVE-2026-50059 · Severity: high · CVSS 7.8 · Published 2026-08-11

Solid Edge is a professional 3D design and product development software used by manufacturing and engineering teams. A memory safety flaw in its file parser allows attackers to craft malicious DFT (Solid Edge drawing) files that, when opened by a user, can crash the application or execute arbitrary code with the user's privileges, potentially compromising sensitive design data and engineering systems.

Technologies: Siemens Solid Edge SE2026. Vendors: Siemens.

Quick answers

Is CVE-2026-50059 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50059 being exploited in the wild.
How severe is CVE-2026-50059?
High severity, with a CVSS score of 7.8, published 11 August 2026.
Which products and versions are affected?
Siemens Solid Edge SE2026 All versions < V226.0 Update 7; Siemens Solid Edge Se2025 All versions < V225.0 Update 15.
Is there a fix for CVE-2026-50059?
A patch was published on 2026-08-11: Patches available: SE2025 Update 15, SE2026 Update 7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50059 attacked?
It is attacked with local access.
Am I affected by CVE-2026-50059?
Check whether you run Siemens Solid Edge SE2026 or Siemens Solid Edge Se2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-50059 is an out-of-bounds write vulnerability (CWE-787) in Solid Edge's DFT file parser. The vulnerability is triggered when the application processes specially crafted DFT files, allowing an attacker to write data beyond allocated buffer boundaries. The attack vector is local with user interaction required (user must open a malicious file). Successful exploitation enables arbitrary code execution in the context of the running Solid Edge process. Siemens has released patches: SE2025 requires Update 15 or later, and SE2026 requires Update 7 or later.

Affected products

  • Siemens Solid Edge SE2025 All versions < V225.0 Update 15
  • Siemens Solid Edge SE2026 All versions < V226.0 Update 7

Timeline

  • 2026-08-11: disclosed: Siemens Security Advisory SSA-621657 published
  • 2026-08-11: patched: Patches available: SE2025 Update 15, SE2026 Update 7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.