Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.6

Simulink may run hidden code from malicious model file

CVE-2026-105043 · published 16 days ago
Summary

Simulink versions before the 2026b release can be tricked by a specially crafted .slx model file. The file can contain blocks that never appear in the editor but are executed when the model is opened, potentially allowing unwanted code to run on your system. Update to the latest version of Simulink or apply the vendor’s patch to prevent this behavior.

What to do
  • Update mathworks simulink to version R2026b or later.
Affected software
VendorProductAffected versions
mathworks simulink < R2026b
Original advisory text
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.6 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-451User Interface (UI) Misrepresentation of Critical Information
Timeline
Published2 Oct 2026
Updated6 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-105043 · NVD
CVE-2026-105043 · MITRE
Track software like this
Free during beta