CVE-2026-44412

HighCVSS 7.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Siemens	Solid Edge SE2026	< V226.0 Update 5

References

https://cert-portal.siemens.com/productcert/html/ssa-921111.html

Timeline

Published: May 12, 2026
Last modified: Oct 23, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-444137.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access CVE-2026-444146.8A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device CVE-2026-444159.1Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remot CVE-2026-444169.8Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended CVE-2026-444177.5The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code CVE-2026-444188.7EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query CVE-2026-44428.8Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a CVE-2026-444208.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow CVE-2026-444218.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow CVE-2026-444228.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR point CVE-2026-444236.5ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller,CVE-2026-444246.5ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenti