CVE-2026-1284

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1284", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2026-01-21T11:57:40.910Z", "datePublished": "2026-01-26T13:25:12.900Z", "dateUpdated": "2026-02-26T15:04:51.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2026-02-03T08:24:00.221Z"}, "title": "Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "SOLIDWORKS eDrawings", "versions": [{"status": "affected", "version": "Release SOLIDWORKS Desktop 2025 SP0", "lessThanOrEqual": "Release SOLIDWORKS Desktop 2025 SP5", "versionType": "custom"}, {"status": "affected", "version": "Release SOLIDWORKS Desktop 2026 SP0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file."}]}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1284"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T04:56:30.341420Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:51.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T04:56:30.341420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T14:39:06.576Z"}}], "cna": {"title": "Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "SOLIDWORKS eDrawings", "versions": [{"status": "affected", "version": "Release SOLIDWORKS Desktop 2025 SP0", "versionType": "custom", "lessThanOrEqual": "Release SOLIDWORKS Desktop 2025 SP5"}, {"status": "affected", "version": "Release SOLIDWORKS Desktop 2026 SP0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1284"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.", "supportingMedia": [{"type": "text/html", "value": "An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2026-02-03T08:24:00.221Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1284", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:04:51.839Z", "dateReserved": "2026-01-21T11:57:40.910Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2026-01-26T13:25:12.900Z", "assignerShortName": "3DS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SOLIDWORKS eDrawings", "vendor": "Dassault Syst\u00e8mes", "versions": [{"lessThanOrEqual": "Release SOLIDWORKS Desktop 2025 SP5", "status": "affected", "version": "Release SOLIDWORKS Desktop 2025 SP0", "versionType": "custom"}, {"status": "affected", "version": "Release SOLIDWORKS Desktop 2026 SP0"}]}], "source": "3DS.Information-Security@3ds.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file."}, {"lang": "es", "value": "Una vulnerabilidad de escritura fuera de l\u00edmites que afecta el procedimiento de lectura de archivos EPRT en SOLIDWORKS eDrawings desde la versi\u00f3n SOLIDWORKS Desktop 2025 hasta la versi\u00f3n SOLIDWORKS Desktop 2026 podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario al abrir un archivo EPRT especialmente dise\u00f1ado."}], "id": "CVE-2026-1284", "lastModified": "2026-06-17T10:15:27.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "3DS.Information-Security@3ds.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1284", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T04:56:30.341420Z", "version": "2.0.3"}}]}, "published": "2026-01-26T14:15:57.020", "references": [{"source": "3DS.Information-Security@3ds.com", "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1284"}], "sourceIdentifier": "3DS.Information-Security@3ds.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "3DS.Information-Security@3ds.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:01:59.189402+00:00", "value": {"mitigation_remediation": ["Update to a SOLIDWORKS Desktop version that includes the vendor\u2019s fix (e.g., 2027 or later);", "Until a patch is available, disable automatic opening of EPRT files or restrict them to trusted sources only;", "Continuously monitor application logs for abnormal EPRT file processing or attempts to inject code, and isolate affected endpoints when suspicious activity is detected."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Dassault Syst\u00e8mes' SOLIDWORKS eDrawings is impacted, specifically Release SOLIDWORKS Desktop 2025 and all builds through Release SOLIDWORKS Desktop 2026. All deployments using these versions are considered vulnerable unless patched or updated to a later release that addresses the flaw.", "description_and_impact": "An out\u2011of\u2011bounds write flaw exists in the EPRT file reading routine of SOLIDWORKS eDrawings. When an attacker opens a specially crafted EPRT file, the flaw allows the program to write beyond an intended buffer, potentially leading to arbitrary code execution. The weakness is classified as CWE\u2011787, a classic memory corruption vulnerability that can compromise confidentiality, integrity and availability by giving malicious code full control over the host system.", "risk_and_exploitability": "The CVSS v3.1 score of 7.8 indicates a high severity level. EPSS is below 1%, suggesting that, as of the latest data, exploitation attempts are rare or unlikely, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the flaw can be leveraged by tricking a user or by an attacker who can place a malicious EPRT file on a machine where the user runs eDrawings. Because the exploitation requires the file to be processed by the application, the likely attack vector is local or via social engineering; a remote exploitation scenario would require the attacker to deliver the file to or cause the user to open it. The combination of high severity and the potential for arbitrary code execution warrants immediate action."}}}}, "created": "2026-01-27T20:17:40.170972+00:00", "updated": "2026-04-18T15:15:03.684924+00:00", "vendors": ["dassault", "dassault$PRODUCT$edrawings"]}