CVE-2026-34789
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
FreeCAD prior to version 1.1.2 has a vulnerability in PropertyPythonObject::Restore() where the attacker-controlled module attribute from serialized PropertyPythonObject XML is passed directly to PyImport_ImportModule() while restoring a crafted FCStd document, executing module-level Python code. The legacy pickle branch also imports an attacker-controlled module and invokes its class constructor.
Risk Assessment
Opening a malicious FCStd file could lead to arbitrary code execution in the context of the application, potentially resulting in system compromise.
Recommendation
Upgrade FreeCAD to version 1.1.2, which contains the fix.
Original NVD description (English source)
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.