Siemens Solid Edge File Parsing Vulnerability Advisory (CVE-2026-50058-64)

Siemens Security Advisory: File Parsing Vulnerabilities in Solid Edge prior to SE2026 Update 7 Vulnerability Overview Solid Edge contains multiple file parsing vulnerabilities that may be triggered when the application reads specially crafted files in PAR, PSM, or DFT formats. This may allow attackers to cause the application to crash or execute arbitrary code. Affected Products Solid Edge SE2025 - All versions < V225.0 Update 15 - Affected CVEs: CVE-2026-50058, CVE-2026-50059, CVE-2026-50060, CVE-2026-50061, CVE-2026-50062, CVE-2026-50063, CVE-2026-50064 Solid Edge SE2026 - All versions < V226.0 Update 7 - Affected CVEs: CVE-2026-50058, CVE-2026-50059, CVE-2026-50060, CVE-2026-50061, CVE-2026-50062, CVE-2026-50063, CVE-2026-50064 Remediation Solid Edge SE2025 - Update to V225.0 Update 15 or later - Remediation Link: https://support.sw.siemens.com/product/24673842/ Solid Edge SE2026 - Update to V226.0 Update 7 or later - Remediation Link: https://support.sw.siemens.com/product/24673842/ Vulnerability Details CVE-2026-50058 Description: A out-of-bounds read vulnerability in the application when parsing specially crafted DFT files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-125: Out-of-bounds Read CVE-2026-50059 Description: A out-of-bounds write vulnerability in the application when parsing specially crafted DFT files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-787: Out-of-bounds Write CVE-2026-50060 Description: A use-after-free vulnerability in the application when parsing specially crafted DFT files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-416: Use After Free CVE-2026-50061 Description: A use-after-free vulnerability in the application when parsing specially crafted DFT files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-416: Use After Free CVE-2026-50062 Description: A out-of-bounds read vulnerability in the application when parsing specially crafted PAR files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-125: Out-of-bounds Read CVE-2026-50063 Description: A out-of-bounds read vulnerability in the application when parsing specially crafted RAR files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-125: Out-of-bounds Read CVE-2026-50064 Description: A out-of-bounds write vulnerability in the application when parsing specially crafted PSM files, which may allow attackers to execute code in the context of the current process. CVSS v3.1 Base Score: 7.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.3 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/HI:H/HA:H/SC:N/NSI:N/SA:N CWE: CWE-787: Out-of-bounds Write Acknowledgments Siemens thanks the following individuals for their contributions: Yutao Wang from YanShangKuKu reported these vulnerabilities. Yu Zhou from Southeast University reported these vulnerabilities. Additional Information For more information about security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT: https://www.siemens.com/cert/advisories History V1.0 (2026-08-11): Release Date Terms of Use Use of Siemens Security Advisories is subject to the listed terms and conditions: https://www.siemens.com/productcert/terms-of-use

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Solid Edge File Parsing Vulnerability Advisory (CVE-2026-50058-64)