CVE-2026-42212
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.31%
- CWE
- CWE-400, CWE-611, CWE-776
- Published
- 2026-05-08
- Last modified
- 2026-05-11
Affected products
- anzory SolidCAM-GPPL-IDE
Weakness type
Related vulnerabilities
- CVE-2026-45769 — ikev2: unbounded client transform storage can lead to resource exhaustion
- CVE-2026-45768 — Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
- CVE-2026-45766 — Suricata nfs: unbounded stateful structures can lead to resource exhaustion
- CVE-2026-45765 — Suricata dnp3: unbounded reassembly can lead to resource exhaustion
- CVE-2026-45759 — Suricata http1: quadratic Content-Disposition processing can lead to denial of service
- CVE-2026-87106 — Consul vulnerable to a denial of service in the native RPC listener
- CVE-2026-9338 — IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-88290 — GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exhaustion