CVE-2026-42212

HighCVSS 7.1

Published: 08/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

34th percentile - higher than 34% of all known CVEs

Summary

The SolidCAM-GPPL-IDE extension in versions from 1.0.0 to before 1.0.2 has a vulnerability that allows the processing of malicious .vmid files, potentially leading to local file disclosure and denial of service attacks.

Risk Assessment

Organizations using this extension may be exposed to data leaks and service availability issues due to malicious XML files.

Recommendation

It is recommended to update the extension to version 1.0.2 or newer to mitigate this vulnerability.

Other vulnerabilities in SolidCAM-GPPL-IDE

CVE-2026-42213Medium
The SolidCAM-GPPL-IDE extension from version 1.0.0 to before 1.0.2 improperly handles the inc "filename" directive in GPPL postprocessor files, resolving arbitrary paths (absolute, relative with parent-directory segments, UNC, and subfolders) into clickable links and calling File.Exists. This results in information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. The issue is patched in version 1.0.2.

Original NVD description (English source)

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS