MATLAB/Simulink Concealed Executable Blocks Vulnerability (CVE-2026-105043)

Vulnerability Overview Vulnerability Name: Concealed executable blocks in MATLAB/Simulink Release Date: September 1, 2026 CVSS Score: 4.0.8.4 (High) CVE ID: CVE-2026-105043 CWE ID: CWE-451 Fix Status: Fixed in R2026b; patch for R2026a is scheduled for release in January 2027 Detailed Description: Simulink models can contain hidden executable blocks that are invisible in the Simulink editor, regardless of how the user scrolls or zooms. Opening and running the model executes attacker-controlled shell commands with the user’s permissions. Verification Environment: MATLAB/Simulink R2026a Update 2 and earlier versions. MathWorks confirmed that such blocks "reduce the visibility of model content when executed during manual inspection" and stated that "additional security measures are appropriate." Scope of Impact Vulnerability Type: Hidden executable blocks Impact: - Code Execution: Download and execute further payloads. - Confidentiality: Directory listing and data exfiltration. - Integrity: Overwriting or deleting files. - Availability: Resource exhaustion and infinite loops. Propagation Vector: Simulink models are commonly shared via vendors, work exchanges, public repositories, publications, etc., making them a potential delivery channel. Remediation Interim Measures: - Treat every third-party model as untrusted code; enumerate it before running or compiling. - Flag blocks with zero dimensions whose Position coordinates are equal to or significantly distant from other blocks. - Review blocks calling , as this function can access the shell and should not be trusted in third-party models. - Use a sandboxed environment: open models on an isolated machine or within containers, without network access or sensitive files. Recommended Fixes: - Enforce minimum block geometry: At least 1x1 pixel to prevent zero-area blocks. - Add Edit-time/Model Advisor checks: For blocks with zero or near-zero area, blocks extending beyond the canvas boundaries, blocks completely covered by other blocks, and MATLAB Function blocks declaring external shell functionality. - Provide a list of hidden blocks: Via the GUI feature "Show all blocks in my model." POC Code Timeline 2026-06-03: Reported to MathWorks with written recommendations and a proof of concept. 2026-07-29: Requested MITRE CVE identifier (CAN-2026-2034772). 2026-09-01: Public disclosure, adhering to the pre-agreed coordinated disclosure deadline. MathWorks requested an extension, but no agreement was reached. 2026-09-24: MathWorks released R2026b, enforcing a minimum block size of 5x5 pixels and fixing the issue. 2026-10-02: MITRE issued CVE-2026-105043. Update: Fixed in R2026b MathWorks R2026b Release: Completely fixed the issue. Simulink Release Notes: - Blocks have a minimum size of 5x5 pixels. - All blocks in a model must be at least 5x5 pixels. Simulink adjusts block coordinates so that width and height are at least 5 pixels in the following cases: - The specified parameter results in a width or height less than 5 pixels. - Opening or loading a model created in a previous version containing one or more blocks with smaller dimensions. Credits Discovery and Reporting: Alexander Boll

Goal Reached Thanks to every supporter — we hit 100%!

MATLAB/Simulink Concealed Executable Blocks Vulnerability (CVE-2026-105043)