A code injection flaw (CWE‑94) in Dassault Systèmes SOLIDWORKS Desktop releases 2025 through 2026 allows an attacker to execute arbitrary code on the user’s machine when a specially crafted file is opened. Key detail from CVE description: the vulnerability is triggered during file processing, providing code execution under the current user’s context and potentially granting full access to the system if the user is an administrator.

Any installation of SOLIDWORKS Desktop that falls within Release 2025 or Release 2026 is vulnerable; no specific sub‑versions or build numbers are listed, and available patches are not provided in the advisories.

The CVSS score of 7.8 indicates moderate‑to‑high severity, while the EPSS of less than 1 % suggests a low current likelihood of exploitation. Based on the description, it is inferred that the attacker must supply a malicious file that the user opens, implying a local, user‑initiated attack vector. The vulnerability is not listed in CISA’s KEV catalog and thus is not known to be actively exploited in the wild. Until an official patch is released, the risk persists for all affected installations, especially for environments that routinely process untrusted design files.