LiveThreat Vulnerability Brief — CVE-2026-1333
What It Is — A remote code execution flaw exists in Dassault Systèmes eDrawings Viewer when parsing specially crafted EPRT files. The vulnerability stems from an uninitialized variable that can be abused to run arbitrary code in the context of the viewer process. Exploitability — A proof‑of‑concept exists; exploitation requires a user to open a malicious EPRT file or visit a page that triggers the file download. CVSS v3.1 base score 7.8 (High).
Affected Products — Dassault Systèmes eDrawings Viewer (all versions prior to the 2026‑02‑19 security update).
TPRM Impact — Many engineering, manufacturing, and aerospace firms embed eDrawings Viewer in partner portals, product documentation pipelines, and supplier collaboration tools. A compromised viewer can serve as a foothold for lateral movement into corporate networks, exposing downstream partners to supply‑chain breach risk.
Recommended Actions —
- Deploy Dassault Systèmes’ security update immediately across all endpoints.
- Conduct an inventory of all systems running eDrawings Viewer and verify patch status.
- Block or sandbox EPRT file types at email and web gateways pending remediation.
- Enable application whitelisting or endpoint detection to flag anomalous execution of the viewer.
- Communicate the risk to third‑party vendors and require proof of remediation in contractual security clauses.