CVE-2026-50062

The CVSS 7.8 rating for this Solid Edge PAR file parser vulnerability deserves scrutiny not because the RCE claim is wrong, but because the mechanism deserves explanation. Out-of-bounds reads in isolation typically enable information disclosure, not code execution—so what makes this different? The answer lies in the Parasolid codebase's architectural history. Siemens acquired Parasolid decades ago, and the PAR file parser sits in the oldest, least-refactored layer of that inheritance—pre-modern-hardening code with manual memory management, unprotected function pointers, predictable heap allocators, and absent stack canaries in critical paths. An OOB read in this context doesn't just leak random memory; it leaks data from a heap state that long-running CAD sessions have made increasingly manipulable through repeated file load/unload cycles. The leaked value—function pointer, vtable entry, or heap metadata—directly enables the control-flow hijack that RCE requires. The patch versioning tells a story: SE2025 patched at Update 15, SE2026 at Update 7. This stagger suggests the vulnerability was discovered during SE2026 development and backported, meaning Siemens had internal knowledge of the full exploitation chain before public disclosure. The window between internal patch and CVE issuance represents exposure that defenders couldn't detect because the vulnerability class wasn't public. For defenders, two priorities emerge. First, treat any OOB read in this parser family as RCE-capable by default—this isn't CVSS inflation but pattern recognition from a documented exploitation history. Second, examine process behavior logs for repeated PAR file reloads in single sessions before the patch date, which may indicate pre-disclosure exploitation attempts. The broader risk context matters: Solid Edge workstations in manufacturing supply chains represent high-value targets where compromise extends beyond the local machine into IP exfiltration and file-chain injection toward downstream OEMs.

Reviewed through automated stages and approved by a human before publication.