LiveThreat Vulnerability Brief — CVE‑2026‑1334
What It Is — A memory‑corruption flaw in the EPRT file parser of Dassault Systèmes eDrawings Viewer allows an attacker to execute arbitrary code in the context of the viewer process. The vulnerability is rated CVSS 3.1 7.8 (High) and requires a victim to open a crafted .eprt file or view a malicious web page that triggers the parser. Exploitability — No public exploit has been released, but proof‑of‑concept code is available to security researchers; the risk is considered active due to the ease of delivering malicious files.
Affected Products — Dassault Systèmes eDrawings Viewer (all versions prior to the February 2026 security update).
TPRM Impact — Organizations that embed eDrawings Viewer in engineering work‑flows, product documentation portals, or supply‑chain collaboration platforms inherit a third‑party software risk. A successful exploit could lead to lateral movement inside corporate networks, exposure of design IP, or deployment of ransomware payloads.
Recommended Actions —
- Deploy Dassault Systèmes’ security update released 2026‑02‑19 immediately.
- Block or sandbox .eprt files from untrusted sources via email gateways and web filters.
- Enforce application whitelisting for eDrawings Viewer and monitor for anomalous process behavior.
- Conduct user awareness training on opening unknown CAD files.
- Verify that any third‑party portals that host eDrawings content have applied the patch.