CVE-2026-1333
Published: 16 February 2026
Summary
CVE-2026-1333 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in 3Ds Solidworks Edrawings. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-1333 by requiring timely remediation of the uninitialized variable flaw in SOLIDWORKS eDrawings via vendor patches.
Provides memory protection mechanisms that hinder exploitation of the uninitialized variable vulnerability leading to arbitrary code execution in EPRT file parsing.
Malicious code protection scans and blocks execution of arbitrary code triggered by specially crafted malicious EPRT files in SOLIDWORKS eDrawings.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via crafted EPRT file opened by user maps to malicious file execution technique.
NVD Description
A Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
Deeper analysisAI
CVE-2026-1333 is a Use of Uninitialized Variable vulnerability (CWE-457) in the EPRT file reading procedure of SOLIDWORKS eDrawings. It affects SOLIDWORKS Desktop releases from 2025 through 2026. Published on 2026-02-16T14:16:18.003, the flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and enables arbitrary code execution upon opening a specially crafted EPRT file.
The vulnerability can be exploited by an attacker with local access who tricks a user into opening a malicious EPRT file, requiring no privileges but relying on user interaction. Successful exploitation allows arbitrary code execution with high impacts to confidentiality, integrity, and availability in the context of the affected application.
Dassault Systèmes has published a security advisory with further details at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-1333, which security practitioners should consult for mitigation and patching guidance.
Details
- CWE(s)