Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42212 SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file… https://www.cve.org/CVERecord?id=CVE-2026-42212
Post summary
The snippet references a CVE record with a brief mention of affected versions and file type but lacks detailed vulnerability, PoC, exploit, or mitigation information.
CVE-2026-42212 XML External Entity Injection in SolidCAM-GPPL-IDE Versions Before 1.0.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42212
Post summary
The text announces a new XML External Entity Injection vulnerability in SolidCAM‑GPPL‑IDE versions prior to 1.0.2, providing only the basic classification and no further exploitation or mitigation details.