The vulnerability is an uninitialized pointer dereference that occurs when Solid Edge SE2026 processes specially crafted PAR files. An attacker can construct such a file to trigger the bug and cause the application to execute arbitrary code in the context of the running process. This flaw, identified as CWE‑824, can lead to compromise of the confidentiality, integrity, and availability of data processed by the product, and may allow the attacker to gain escalated privileges within the application environment.

The affected component is Siemens Solid Edge SE2026. All releases prior to V226.0 Update 5 are impacted, regardless of platform or module. Users running these legacy versions should verify their current build against the vendor’s release notes and apply the latest update when available.

The CVSS base score of 7.3 indicates a high severity. With no EPSS data and current exclusion from CISA KEV, the exploitation likelihood remains a concern. The attack path requires access to a user who can open or otherwise trigger parsing of a malicious PAR file, making it a local or user‑initiated threat. Because the bug leads to code execution in the current process, it can be leveraged to take full control of the application instance.