A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family… (CVE-2026-34223)

CVE-2026-34223 is a client code execution vulnerability in Desigo CC client applications caused by insufficient input validation of scripts embedded in user-defined graphics documents. When a user opens a maliciously crafted graphics document, the embedded script executes within the client application context, allowing an attacker to write arbitrary files to the client operating system. Exploitation requires user interaction with a malicious graphics document and privileges sufficient to execute the embedded commands. This vulnerability affects all versions of multiple Desigo CC client variants, including ClickOnce Client V6 and V7, family V8 and V9, Flex Client V6 and V7, and Installed Client V6 and V7. The CVSS v3.1 base score is 8.2, reflecting high impact on confidentiality, integrity, and availability with low attack complexity but requiring user interaction and privileges.

Successful exploitation can lead to arbitrary file writes on the client operating system, resulting in full compromise of the client machine. This may enable attackers to execute code, escalate privileges, and move laterally within the affected organization’s network. The vulnerability impacts confidentiality, integrity, and availability of the client system.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening graphics documents from untrusted sources and limit privileges of users who handle such documents. Monitor vendor communications for updates and apply patches promptly once released.