CVE-2026-3476

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3476
A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitrary code on the user's machine while opening a specially crafted file.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.3ds.com/trust-center/security/security-advisories/cve-2026-3476 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:3ds:solidworks:*:*:*:*:*:*:*:*
cpe:2.3:a:3ds:solidworks:2026:sp0:*:*:*:*:*:*
History

08 Jun 2026, 14:36

Type Values Removed Values Added
References () https://www.3ds.com/trust-center/security/security-advisories/cve-2026-3476 - () https://www.3ds.com/trust-center/security/security-advisories/cve-2026-3476 - Vendor Advisory
Summary
  • (es) Una vulnerabilidad de inyección de código que afecta a SOLIDWORKS Desktop desde la versión 2025 hasta la versión 2026 podría permitir a un atacante ejecutar código arbitrario en la máquina del usuario al abrir un archivo especialmente diseñado.
CPE cpe:2.3:a:3ds:solidworks:*:*:*:*:*:*:*:*
cpe:2.3:a:3ds:solidworks:2026:sp0:*:*:*:*:*:*
First Time 3ds solidworks
3ds

16 Mar 2026, 16:16

Type Values Removed Values Added
References
  • {'url': 'https://www.3ds.com/trust-center/security/security-advisories/CVE-2026-3476', 'source': '3DS.Information-Security@3ds.com'}
  • () https://www.3ds.com/trust-center/security/security-advisories/cve-2026-3476 -
Summary (en) A Code Injection vulnerability affecting in SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitrary code on the user's machine while opening a specially crafted file. (en) A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitrary code on the user's machine while opening a specially crafted file.

16 Mar 2026, 14:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:19

Updated : 2026-06-08 14:36

NVD link : CVE-2026-3476

Mitre link : CVE-2026-3476

CVE.ORG link : CVE-2026-3476

JSON object : View

Products Affected

3ds

  • solidworks
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')