CVE-2026-34789 FreeCAD CVE debrief

Who should care

Users of FreeCAD versions prior to 1.1.2 should assess their exposure and take necessary actions to mitigate the risk. This includes upgrading to version 1.1.2 or later, restricting access to FCStd documents from untrusted sources, and monitoring FreeCAD usage for suspicious activity. Security teams and operators of affected systems should prioritize this vulnerability due to its high severity and potential for arbitrary code execution.

Why it matters

CVE-2026-34789 is a high-severity vulnerability in FreeCAD that allows attackers to execute arbitrary Python code via crafted FCStd documents. Users of FreeCAD versions prior to 1.1.2 should upgrade to version 1.1.2 or later and restrict access to FCStd documents from untrusted sources.

• Arbitrary Python code execution
• Potential for data tampering or theft
• Possible disruption of FreeCAD usage
• Verification of FreeCAD version and exposure required

Technical summary

The vulnerability exists in the PropertyPythonObject::Restore() function in src/App/PropertyPythonObject.cpp. When restoring a crafted FCStd document, the function passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule(), executing module-level Python code. The legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject().

Defensive priority

High

Recommended defensive actions

• Upgrade to FreeCAD version 1.1.2 or later
• Restrict access to FCStd documents from untrusted sources
• Monitor FreeCAD usage for suspicious activity
• Verify FreeCAD version and exposure
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7 and HIGH severity. The issue is fixed in FreeCAD version 1.1.2. The vulnerability was publicly disclosed on 2026-08-17 and has not been modified since then. There is no evidence of exploitation in the wild, but users are advised to take necessary precautions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.