Code Execution in FreeCAD via Malicious FCStd Document

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-34789

Affected Vendors & Products

Vendor	Product	Version / Range
freecad	freecad	1.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in FreeCAD versions prior to 1.1.2 allows an attacker to execute arbitrary Python code by crafting a malicious FCStd document. The issue occurs when restoring a document, where attacker-controlled module attributes are passed directly to Python import functions, enabling code execution.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system when you open a specially crafted FreeCAD document. This could lead to unauthorized access, data theft, or system compromise depending on the attacker's goals.

Mitigation Strategies

Update FreeCAD to version 1.1.2 or later to address the vulnerability in PropertyPythonObject::Restore(). Avoid opening untrusted FCStd documents until patched.

Hi! I’m here to help you understand CVE-2026-34789. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70