CVE-2026-34398 FreeCAD CVE debrief

Who should care

Defenders responsible for FreeCAD deployments, particularly those using the BIM Project Manager feature, should assess exposure and prioritize upgrading to version 1.1.1 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions and remediate the vulnerability.

Why it matters

CVE-2026-34398 is a high-severity vulnerability in FreeCAD's BIM Project Manager Load Template flow. Defenders should prioritize upgrading to version 1.1.1 or later to prevent potential code execution. The vulnerability allows arbitrary Python code execution when loading a malicious BIM project template. Evidence is based on official CVE and NVD records, as well as source references from the FreeCAD project.

• Potential arbitrary Python code execution
• Possible compromise of FreeCAD systems
• Need for verification of affected versions and remediation

Technical summary

The BIM Project Manager Load Template flow in FreeCAD passes attacker-controlled FCStd Meta property values to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1. The vulnerability impacts FreeCAD deployments using the BIM Project Manager feature, and defenders should prioritize upgrading to version 1.1.1 or later to prevent potential code execution. Affected systems may be compromised if an attacker provides a malicious BIM project template.

Defensive priority

Defenders should prioritize upgrading to FreeCAD version 1.1.1 or later to prevent potential code execution.

Recommended defensive actions

• Upgrade to FreeCAD version 1.1.1 or later
• Restrict loading of untrusted BIM project templates
• Monitor for suspicious activity in FreeCAD
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by passing attacker-controlled FCStd Meta property values to eval() in the BIM Project Manager Load Template flow. This issue is fixed in version 1.1.1. Evidence is based on official CVE and NVD records, as well as source references from the FreeCAD project. The FreeCAD project has addressed this issue in version 1.1.1, and defenders should verify affected versions and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.