Dassault Systèmes SOLIDWORKS Desktop is vulnerable to a code injection flaw that enables arbitrary code execution when a victim opens a malicious file, posing a significant risk to local system integrity.

This is a code injection vulnerability (CWE-94) that occurs when the application improperly processes input from a crafted file. The attack vector is local, requiring user interaction to trigger the execution, and the attacker does not require prior authentication.

A successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the logged-in user. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, data theft, or the installation of persistent malware within the corporate environment.

Immediate Action: Update all instances of SOLIDWORKS Desktop to the latest patched version provided by Dassault Systèmes as detailed in their security advisory.

Proactive Monitoring: Monitor endpoint systems for suspicious child processes spawned by SOLIDWORKS, such as command shells or unauthorized scripts, and review system logs for unusual file access patterns.

Compensating Controls: Ensure that users are educated on the risks of opening files from untrusted sources and utilize endpoint security solutions that can detect and block malicious code execution at the process level.

Public Exploit Available: No

This vulnerability presents a clear risk to workstation security and must be addressed with urgency. Administrators should prioritize the deployment of the vendor-provided patches across all affected SOLIDWORKS installations to eliminate the risk of arbitrary code execution stemming from the processing of untrusted files.