CVE-2026-1333: SOLIDWORKS eDrawings RCE Vulnerability

CVE-2026-1333 Overview

CVE-2026-1333 is a Use of Uninitialized Variable vulnerability [CWE-457] in the EPRT file reading procedure of SOLIDWORKS eDrawings. The flaw affects SOLIDWORKS Desktop releases 2025 through 2026. An attacker who convinces a user to open a specially crafted .EPRT file can execute arbitrary code in the context of the current user. Dassault Systèmes published a security advisory tracking this issue under CVE-2026-1333.

Critical Impact
Arbitrary code execution on engineering workstations through a maliciously crafted EPRT file opened in SOLIDWORKS eDrawings.

Affected Products

SOLIDWORKS eDrawings 2025 (base release through SP5.0)
SOLIDWORKS eDrawings 2026 (base release)
SOLIDWORKS eDrawings 2026 SP1.1

Discovery Timeline

2026-02-16 - CVE-2026-1333 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-1333

Vulnerability Analysis

The vulnerability resides in the EPRT file parsing routine of SOLIDWORKS eDrawings. When the application processes a malformed EPRT file, the parser references a variable before initialization. The uninitialized memory carries attacker-influenced data from prior allocations on the stack or heap. This unchecked value is then used in program logic, including pointer arithmetic or function dispatch.

An attacker who controls the layout of memory at the time of parsing can steer execution toward arbitrary code. Exploitation requires local file access and user interaction, since the target must open the malicious EPRT file. Successful exploitation yields full confidentiality, integrity, and availability impact within the user context.

Root Cause

The root cause is classified as [CWE-457] Use of Uninitialized Variable. The EPRT reader allocates a structure or local variable but fails to set its contents on certain parsing paths. When subsequent code reads the value, it consumes residual memory contents instead of validated input. This pattern is common in complex binary file parsers that branch heavily on input fields.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted EPRT file through email, shared engineering repositories, supplier portals, or USB media. When a SOLIDWORKS eDrawings user opens the file, the parser triggers the uninitialized read. Code execution proceeds under the privileges of the SOLIDWORKS process. CAD environments often run on engineering workstations with access to intellectual property, making them attractive targets for intrusion sets focused on industrial espionage.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details beyond the vendor advisory have not been published. Refer to the 3DS Security Advisory CVE-2026-1333 for vendor-supplied information.

Detection Methods for CVE-2026-1333

Indicators of Compromise

Unexpected .EPRT files arriving via email attachments, supplier file exchanges, or unmanaged USB media on engineering workstations.
Child processes spawned by eDrawings.exe or SLDWORKS.exe that are inconsistent with normal CAD workflows, such as command shells, scripting engines, or LOLBins.
Crash dumps or Windows Error Reporting events referencing the eDrawings EPRT parser modules immediately before suspicious process activity.

Detection Strategies

Hunt for SOLIDWORKS eDrawings processes loading EPRT files from temporary directories, browser download folders, or email client cache paths.
Correlate file-open telemetry for .EPRT extensions with subsequent process creation, network egress, or persistence registry writes from the same parent.
Inspect endpoint logs for repeated unexpected terminations of eDrawings.exe that may indicate failed exploitation attempts.

Monitoring Recommendations

Inventory all hosts running SOLIDWORKS eDrawings 2025 and 2026 and validate installed service pack levels against the vendor advisory.
Monitor outbound connections from CAD workstations to non-corporate destinations following EPRT file opens.
Enable Windows Defender Exploit Guard or equivalent process mitigation logging for the SOLIDWORKS eDrawings executable.

How to Mitigate CVE-2026-1333

Immediate Actions Required

Apply the fixed release identified in the 3DS Security Advisory CVE-2026-1333 to all affected SOLIDWORKS eDrawings installations.
Restrict the opening of EPRT files to trusted sources and validated internal engineering repositories.
Communicate the threat to CAD users and instruct them to avoid opening unsolicited EPRT attachments.

Patch Information

Dassault Systèmes has published a security advisory for CVE-2026-1333 covering SOLIDWORKS eDrawings 2025 and 2026. Administrators should consult the vendor advisory for the specific fixed service pack versions and apply updates through standard SOLIDWORKS deployment channels.

Workarounds

Block inbound .EPRT files at email gateways and web proxies until patching is complete.
Use application allowlisting to constrain child processes that eDrawings.exe is permitted to spawn.
Run SOLIDWORKS eDrawings under least-privileged user accounts to limit post-exploitation impact.

bash

# Example: PowerShell command to enumerate installed SOLIDWORKS eDrawings versions
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like '*eDrawings*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation