CVE-2026-3476
Published: 16 March 2026
Summary
CVE-2026-3476 is a high-severity Code Injection (CWE-94) vulnerability in 3Ds Solidworks. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 9.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-3476 is a code injection vulnerability (CWE-94) affecting SOLIDWORKS Desktop from Release 2025 through Release 2026. Published on 2026-03-16T14:19:48.130, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The issue enables arbitrary code execution on the user's machine when opening a specially crafted file.
The vulnerability can be exploited by an attacker with local access who tricks a user into opening a malicious file, requiring low attack complexity and user interaction but no privileges. Successful exploitation allows the attacker to achieve high-impact effects, including unauthorized access to sensitive data, modification of system files, and disruption of services on the affected workstation.
Mitigation details and patches are outlined in the official advisory from Dassault Systèmes, available at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-3476. Security practitioners should consult this resource for specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12419
Vulnerability details
A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitrary code on the user's machine while opening a specially crafted file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side code injection flaw that directly results in arbitrary code execution upon opening a malicious file, mapping to T1204.002 User Execution: Malicious File.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing CVE-2026-3476 by mandating application of the vendor patch to eliminate the code injection vulnerability.
SI-10 enforces information input validation to check file contents, preventing code injection attacks like CVE-2026-3476 during parsing of specially crafted SOLIDWORKS files.
SI-16 implements memory protections such as DEP and ASLR to block execution of arbitrary code injected via malicious files exploiting CVE-2026-3476.