CVE-2025-9976 - OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

Back Back to CVE browser

CRITICAL

OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

Published Oct 13, 2025

9.0

CRITICAL

CVSS 3.1

EPSS 0.90%

Description

An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.

Affected products

Vendor Dassault Systèmes Product Station Launcher App in 3DEXPERIENCE platform Default
unaffected
- Version
  Release 3DEXPERIENCE R2022x Golden
  Status
  affected
  Constraints
  <=Release 3DEXPERIENCE R2022x.FP.CFA.2540
- Version
  Release 3DEXPERIENCE R2023x Golden
  Status
  affected
  Constraints
  <=Release 3DEXPERIENCE R2023x.FP.CFA.2532
- Version
  Release 3DEXPERIENCE R2024x Golden
  Status
  affected
  Constraints
  <=Release 3DEXPERIENCE R2024x.FP.CFA.2537
- Version
  Release 3DEXPERIENCE R2025x Golden
  Status
  affected
  Constraints
  <=Release 3DEXPERIENCE R2025x.FP.CFA.2532

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dassault Systèmes

Station Launcher App in 3DEXPERIENCE platform

unaffected

Version	Status	Constraints
Release 3DEXPERIENCE R2022x Golden	affected	<=Release 3DEXPERIENCE R2022x.FP.CFA.2540
Release 3DEXPERIENCE R2023x Golden	affected	<=Release 3DEXPERIENCE R2023x.FP.CFA.2532
Release 3DEXPERIENCE R2024x Golden	affected	<=Release 3DEXPERIENCE R2024x.FP.CFA.2537
Release 3DEXPERIENCE R2025x Golden	affected	<=Release 3DEXPERIENCE R2025x.FP.CFA.2532