Siemens Solid Edge patches file-parsing flaws

Siemens fixed seven vulnerabilities in Solid Edge that could let attackers execute code via malicious PAR, PSM, or DFT files.

Siemens has released updates for Solid Edge SE2025 and SE2026 addressing seven file-parsing vulnerabilities (CVE-2026-50058 through CVE-2026-50064). The flaws stem from out-of-bounds read/write and use-after-free conditions triggered when the application parses specially crafted PAR, PSM, or DFT files, and could allow an attacker to crash the application or execute arbitrary code in the context of the current process.

Exploitation requires a victim to open a malicious file, making this a local/client-side attack vector typical of CAD software vulnerabilities rather than a remotely exploitable network service flaw. Siemens ProductCERT reported the issues to CISA, and no active exploitation has been reported. Affected users should update to Solid Edge SE2025 V225.0 Update 15 or Solid Edge SE2026 V226.0 Update 7 or later.

This advisory is relevant to the Critical Manufacturing sector, with Solid Edge deployed worldwide. CISA's standard recommendations apply: minimize network exposure of control system devices, isolate ICS networks from business networks, and use secure remote access methods such as VPNs where necessary.

title: Solid Edge Processing Malicious CAD File
description: Detects Solid Edge (sldworks.exe or related process) opening or processing
  PAR, PSM, or DFT files - file-parsing vulnerability exploitation vector. This rule
  is designed to catch the opening of potentially malicious CAD files that trigger
  CVE-2026-50058 through CVE-2026-50064 vulnerabilities.
tags:
- attack.initial-access
- attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \sldworks.exe
    - \solid.exe
    TargetFilename|endswith:
    - .par
    - .psm
    - .dft
  filter_legitimate_workspace:
    TargetFilename|contains:
    - \Program Files
    - \ProgramData
  condition: selection and not filter_legitimate_workspace
falsepositives:
- Legitimate engineering workflows opening CAD files from shared project directories
- Automated CAD file processing by batch scripts in manufacturing environments
level: medium
id: e7cbc95c-2bbf-5681-a7ea-893aaee6f298
status: experimental
author: Vorant

title: Suspicious Child Process Spawned by Solid Edge
description: Detects Solid Edge spawning child processes such as cmd.exe, powershell.exe,
  or rundll32.exe - potential code execution from parsing malicious CAD file via out-of-bounds
  or use-after-free vulnerability.
tags:
- attack.initial-access
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \sldworks.exe
    - \solid.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    - \msiexec.exe
    - \regsvcs.exe
  filter_solid_edge_plugins:
    CommandLine|contains:
    - help
    - /?
  condition: selection and not filter_solid_edge_plugins
falsepositives:
- Solid Edge plugins or extensions spawning system utilities for legitimate CAD operations
- Third-party integrations (e.g., PDM or PLM systems) invoking command-line tools
  from Solid Edge context
level: high
id: 35ac89b5-ff6a-5733-8292-3d532b6239cc
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-12