CVE-2026-1283

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1283", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2026-01-21T11:57:34.125Z", "datePublished": "2026-01-26T13:25:04.586Z", "dateUpdated": "2026-02-26T15:04:52.136Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2026-02-03T08:23:16.744Z"}, "title": "Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "SOLIDWORKS eDrawings", "versions": [{"status": "affected", "version": "Release SOLIDWORKS Desktop 2025 SP0", "lessThanOrEqual": "Release SOLIDWORKS Desktop 2025 SP5", "versionType": "custom"}, {"status": "affected", "version": "Release SOLIDWORKS Desktop 2026 SP0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file."}]}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1283"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1283", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T04:56:31.095697Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:52.136Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1283", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T04:56:31.095697Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T14:43:47.059Z"}}], "cna": {"title": "Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "SOLIDWORKS eDrawings", "versions": [{"status": "affected", "version": "Release SOLIDWORKS Desktop 2025 SP0", "versionType": "custom", "lessThanOrEqual": "Release SOLIDWORKS Desktop 2025 SP5"}, {"status": "affected", "version": "Release SOLIDWORKS Desktop 2026 SP0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1283"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.", "supportingMedia": [{"type": "text/html", "value": "A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2026-02-03T08:23:16.744Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1283", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:04:52.136Z", "dateReserved": "2026-01-21T11:57:34.125Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2026-01-26T13:25:04.586Z", "assignerShortName": "3DS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SOLIDWORKS eDrawings", "vendor": "Dassault Syst\u00e8mes", "versions": [{"lessThanOrEqual": "Release SOLIDWORKS Desktop 2025 SP5", "status": "affected", "version": "Release SOLIDWORKS Desktop 2025 SP0", "versionType": "custom"}, {"status": "affected", "version": "Release SOLIDWORKS Desktop 2026 SP0"}]}], "source": "3DS.Information-Security@3ds.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo que afecta al procedimiento de lectura de archivos EPRT en SOLIDWORKS eDrawings desde la versi\u00f3n SOLIDWORKS Desktop 2025 hasta la versi\u00f3n SOLIDWORKS Desktop 2026 podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario al abrir un archivo EPRT especialmente dise\u00f1ado."}], "id": "CVE-2026-1283", "lastModified": "2026-06-17T10:15:27.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "3DS.Information-Security@3ds.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1283", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T04:56:31.095697Z", "version": "2.0.3"}}]}, "published": "2026-01-26T14:15:56.853", "references": [{"source": "3DS.Information-Security@3ds.com", "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1283"}], "sourceIdentifier": "3DS.Information-Security@3ds.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "3DS.Information-Security@3ds.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:02:29.964325+00:00", "value": {"mitigation_remediation": ["Apply the Dassault Syst\u00e8mes security update that addresses the buffer overflow in SOLIDWORKS eDrawings.", "Verify that EPRT files originate from trusted sources and do not automatically open unknown files.", "Use endpoint protection and file integrity monitoring to detect anomalous EPRT files before opening them.", "Upgrade to a SOLIDWORKS eDrawings release newer than 2026 if available."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Dassault Syst\u00e8mes SOLIDWORKS eDrawings across Desktop releases 2025 through 2026. Any deployment of these releases running the eDrawings component is susceptible when processing EPRT files. Versions prior to 2025 and later than 2026 are not impacted.", "description_and_impact": "A heap\u2011based buffer overflow occurs in the EPRT file reading routine of SOLIDWORKS eDrawings, allowing a maliciously crafted EPRT file to cause the program to execute arbitrary code. The vulnerability permits an attacker to compromise confidentiality, integrity, and availability of the affected system by running code with the privileges of the eDrawings user.\n\nThe vulnerability is classified as CWE\u2011122, a heap overflow weakness that can be triggered when processing lawful or malicious input. The representation side of the vulnerability does not expose any network controls; it relies on the user opening the compromised file.\n\nExecution is feasible by delivering a specially constructed EPRT file to a user who opens it in the affected application. The CVSS score of 7.8 indicates high severity, but the EPSS score of <1% shows a very low likelihood of exploitation overall; the vulnerability is not listed in the CISA KEV catalog.", "risk_and_exploitability": "The flaw is a heap\u2011based buffer overflow (CWE\u2011122) that can be triggered by opening a specially crafted EPRT file. Attackers must supply a file to a credentialed or non\u2011credentialed user; no remote network trigger is required. The CVSS score of 7.8 signals high severity, but the EPSS <1% indicates a very low overall likelihood of exploitation. The vulnerability is currently not listed in the CISA KEV catalog, suggesting no known widespread weaponization."}}}}, "created": "2026-01-27T20:17:38.807417+00:00", "updated": "2026-04-18T15:15:03.685461+00:00", "vendors": ["dassault", "dassault$PRODUCT$edrawings"]}