CVE-2026-50063: Solid Edge PAR File RCE Vulnerability

CVE-2026-50063 Overview

CVE-2026-50063 is an out-of-bounds read vulnerability [CWE-125] affecting Siemens Solid Edge SE2025 and SE2026. The flaw resides in the PAR file parsing logic. An attacker can craft a malicious PAR file that, when opened by a victim, triggers memory access outside allocated buffer bounds. Successful exploitation allows the attacker to execute code in the context of the current process.

Siemens documented the issue in Security Advisory SSA-621657. The vulnerability requires local file access and user interaction, limiting mass exploitation but remaining useful in targeted attacks against engineering workstations.

Critical Impact
Attackers can achieve code execution on engineering workstations by convincing a user to open a specially crafted PAR file in Solid Edge.

Affected Products

Siemens Solid Edge SE2025 — all versions prior to V225.0 Update 15
Siemens Solid Edge SE2026 — all versions prior to V226.0 Update 7
Component: PAR file parser

Discovery Timeline

2026-08-11 - CVE-2026-50063 published to the National Vulnerability Database (NVD)
2026-08-11 - Siemens publishes Security Advisory SSA-621657
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-50063

Vulnerability Analysis

Solid Edge is a computer-aided design (CAD) application widely used in mechanical engineering workflows. The vulnerability affects the routines responsible for parsing PAR (Part) files, Solid Edge's proprietary format for storing 3D part geometry.

When the application processes a malformed PAR file, its parser reads memory beyond the boundary of an allocated buffer. This out-of-bounds read [CWE-125] can leak adjacent memory contents or corrupt program state used in subsequent operations. Under the right conditions, an attacker can steer the resulting behavior toward arbitrary code execution within the Solid Edge process context.

Code executes with the privileges of the interactive user running Solid Edge. On typical engineering workstations, this often means access to sensitive design intellectual property and lateral movement opportunities into product data management (PDM) systems.

Root Cause

The root cause is missing or insufficient bounds checking during PAR file field parsing. The parser trusts length or offset fields embedded within the file structure without validating them against actual buffer sizes. A crafted file supplies values that cause read operations past the intended memory region.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a weaponized PAR file through email attachments, shared engineering repositories, supplier data exchanges, or removable media. The victim must open the file in a vulnerable Solid Edge installation to trigger the parser flaw.

No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical mechanics are described in the Siemens Security Advisory SSA-621657.

Detection Methods for CVE-2026-50063

Indicators of Compromise

Unexpected Solid Edge process crashes or Edge.exe fault events in the Windows Application event log
PAR files arriving from untrusted sources such as external email, cloud file shares, or removable media
Child processes spawned by Edge.exe that are inconsistent with normal CAD workflows (for example, cmd.exe, powershell.exe, or rundll32.exe)
Outbound network connections originating from the Solid Edge process to unfamiliar destinations

Detection Strategies

Monitor process lineage for Solid Edge spawning shells, script interpreters, or LOLBins immediately after opening a document
Alert on Solid Edge process crashes correlated with the opening of a PAR file to identify exploitation attempts or failed runs
Inspect email gateways and file shares for PAR attachments originating outside trusted partner networks
Deploy YARA or file-type inspection to flag PAR files with anomalous structural sizes or malformed headers

Monitoring Recommendations

Enable Windows Defender Exploit Guard or equivalent memory protection telemetry for the Solid Edge executable
Ingest endpoint process, file, and crash telemetry into a SIEM or data lake to correlate PAR file activity with anomalous child processes
Track version inventory across engineering workstations to identify hosts running V225.0 prior to Update 15 or V226.0 prior to Update 7

How to Mitigate CVE-2026-50063

Immediate Actions Required

Update Solid Edge SE2025 to V225.0 Update 15 or later
Update Solid Edge SE2026 to V226.0 Update 7 or later
Instruct engineering users not to open PAR files received from untrusted or unverified sources
Restrict PAR file transfers through email and cloud shares to known supplier and partner channels

Patch Information

Siemens has released fixed versions addressing CVE-2026-50063. Administrators should deploy V225.0 Update 15 for Solid Edge SE2025 and V226.0 Update 7 for Solid Edge SE2026. Refer to the Siemens Security Advisory SSA-621657 for download locations and installation guidance.

Workarounds

Only open PAR files from trusted sources with verified provenance
Isolate CAD workstations from general-purpose email and web browsing where feasible
Apply application allowlisting to prevent Solid Edge from spawning shell or script interpreters
Run Solid Edge under standard user accounts to limit the impact of process-context code execution

bash

# Verify installed Solid Edge version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Siemens\Solid Edge\Version *\Install" |
  Select-Object PSChildName, InstalledDir, Version