CVE-2026-105043 in Simulink
Summary
by MITRE • 10/03/2026
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified involves MathWorks Simulink versions prior to release 2026b and presents a critical security risk related to arbitrary code execution through maliciously crafted model files. Specifically, when an attacker provides a specially constructed .slx file, which is the standard package format for Simulink models containing blocks, parameters, and configuration data in XML-based structure, it can exploit parsing logic flaws within the application. The core technical flaw lies in how Simulink processes hidden or non-rendered block definitions during the loading phase of a model. While these specific blocks are designed to be invisible within the graphical user interface of the Simulink Editor, meaning they do not appear on the canvas for visual inspection by the end-user, their underlying code execution logic is still initialized and triggered upon file opening. This discrepancy between visual representation and functional initialization creates a significant blind spot for security auditing and manual review processes that rely solely on visual verification of model components.
From an operational perspective, this vulnerability allows for remote code execution if a user opens the malicious .slx file within Simulink. Since Simulink is widely used in engineering disciplines such as aerospace, automotive, and industrial control systems to design and simulate dynamic systems, compromising these environments can lead to severe consequences including intellectual property theft, manipulation of simulation results leading to faulty real-world system designs, or further lateral movement into connected networks if the host machine has network access. The attack vector is primarily social engineering based, requiring a user to open a file that appears legitimate but contains hidden malicious payloads embedded within the model structure. This bypasses traditional perimeter defenses because the threat originates from trusted software executing code defined in what seems like standard data files.
In terms of industry standards and classification frameworks, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) or potentially CWE-200 Information Exposure if sensitive internal states are leaked during execution. It also maps to MITRE ATT&CK techniques such as T1566 Phishing for Initial Access via malicious attachments and T1059 Command and Scripting Interpreter if the executed code invokes system commands or scripts. The hidden nature of the blocks suggests an attempt to evade detection by security tools that might scan visible components, highlighting a need for deeper static analysis capabilities in model validation processes.
Mitigation strategies must focus on both immediate remediation and long-term defensive posture improvements. MathWorks has addressed this issue in Simulink R2026b and later versions; therefore, the primary recommendation is to upgrade immediately to the latest stable release where the parsing logic for hidden blocks has been hardened. For organizations unable to update instantly, implementing strict file intake policies is crucial. This includes restricting the opening of .slx files from untrusted sources, using sandboxed environments for initial inspection, and employing automated scanning tools that can parse XML structures within these packages without rendering them visually. Additionally, enabling macro security settings or disabling automatic model execution upon load can reduce the risk profile until patches are applied. Continuous monitoring of file access logs and anomaly detection in user behavior patterns can also help identify attempts to exploit this vulnerability before successful code execution occurs.