CVE-2026-34223

Name of the Vulnerable Software and Affected Versions Desigo CC ClickOnce Client versions V6 and V7 Desigo CC family versions V8 and V9 Desigo CC Flex Client versions V6 and V7 Desigo CC Installed Client versions V6 and V7

Description Insufficient input validation when handling scripts embedded within user-defined graphics documents allows for Client Code Execution (CCE). An attacker can design or modify a graphics document to include malicious commands. When a user with sufficient privileges opens the compromised document, the embedded script executes on the client application instance, enabling the attacker to write arbitrary files to the client's operating system. This may lead to a full compromise of the client system and potential lateral movement within the organization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.