# CVE-2026-50060: Siemens Solid Edge use-after-free in DFT file parsing

Source: https://junglewise.ai/threats/cve-2026-50060-siemens-solid-edge-use-after-free-in-dft-file-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-50060 · Severity: high · CVSS 7.8 · Published 2026-08-11

Solid Edge is a professional 3D CAD design and product development software suite used by engineering teams. A use-after-free memory vulnerability in the DFT file parser allows attackers to execute arbitrary code when users open specially crafted design files, potentially compromising design data and system integrity.

Technologies: [Siemens Solid Edge SE2026](https://junglewise.ai/threats/technologies/solid-edge). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-50060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50060 being exploited in the wild.

**How severe is CVE-2026-50060?** High severity, with a CVSS score of 7.8, published 11 August 2026.

**Which products and versions are affected?** Siemens Solid Edge SE2026 All versions < V226.0 Update 7; Siemens Solid Edge Se2025 All versions < V225.0 Update 15.

**Is there a fix for CVE-2026-50060?** A patch was published on 2026-08-11: Patches released: SE2025 Update 15 and SE2026 Update 7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50060 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-50060?** Check whether you run Siemens Solid Edge SE2026 or Siemens Solid Edge Se2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CVE-2026-50060) is a use-after-free flaw in Solid Edge's DFT file parser triggered when parsing specially crafted files. The attack requires user interaction (opening a malicious file) but requires no privileges or authentication. An attacker can achieve arbitrary code execution in the context of the Solid Edge process. Siemens has released patches: Solid Edge SE2025 Update 15 and SE2026 Update 7 address this and related file parsing vulnerabilities (CVE-2026-50058 through CVE-2026-50064 affecting DFT, PAR, and PSM file formats).

## Affected products

- Siemens Solid Edge SE2025 All versions < V225.0 Update 15
- Siemens Solid Edge SE2026 All versions < V226.0 Update 7

## Timeline

- 2026-08-11: disclosed: Public disclosure via Siemens ProductCERT advisory SSA-621657
- 2026-08-11: patched: Patches released: SE2025 Update 15 and SE2026 Update 7

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-621657.html](https://cert-portal.siemens.com/productcert/html/ssa-621657.html)

## Related threats

- [Siemens Solid Edge out-of-bounds write in PSM file parsing](https://junglewise.ai/threats/cve-2026-50064-siemens-solid-edge-out-of-bounds-write-in-psm-file-parsing)
- [Siemens Solid Edge out-of-bounds read in PAR file parsing](https://junglewise.ai/threats/cve-2026-50063-siemens-solid-edge-out-of-bounds-read-in-par-file-parsing)
- [Siemens Solid Edge out-of-bounds read in PAR file parsing](https://junglewise.ai/threats/cve-2026-50062-siemens-solid-edge-out-of-bounds-read-in-par-file-parsing)
- [Siemens Solid Edge use-after-free in DFT file parsing](https://junglewise.ai/threats/cve-2026-50061-siemens-solid-edge-use-after-free-in-dft-file-parsing)
- [Siemens Solid Edge out-of-bounds write in DFT file parsing](https://junglewise.ai/threats/cve-2026-50059-siemens-solid-edge-out-of-bounds-write-in-dft-file-parsing)