LiveThreat Vulnerability Brief — CVE‑2026‑1335
What It Is — A critical out‑of‑bounds write flaw in Dassault Systèmes eDrawings Viewer’s EPRT file parser enables remote code execution. The vulnerability (CVSS 7.8) requires a victim to open a malicious .eprt file or view a crafted web page that triggers the parser. Exploitability — No public exploit or PoC has been released, but the attack vector is low‑complexity and fully functional once a malicious file is processed.
Affected Products — Dassault Systèmes eDrawings Viewer (all versions prior to the 2026‑02‑19 security update).
TPRM Impact — Organizations that embed eDrawings Viewer in design‑review pipelines, partner portals, or supply‑chain collaboration tools inherit a direct code‑execution risk. A compromised viewer can be leveraged to pivot into internal networks, exfiltrate design data, or implant malware that propagates to downstream partners.
Recommended Actions —
- Deploy Dassault Systèmes’ patch released 19 Feb 2026 immediately on all endpoints and servers running eDrawings Viewer.
- Block or quarantine .eprt files at perimeter and email gateways until patches are applied.
- Update endpoint detection rules to flag anomalous process launches from the eDrawings executable.
- Conduct a rapid inventory of all third‑party tools that embed eDrawings Viewer and verify they are patched.
- Communicate the risk to design‑team partners and require them to apply the same update.