Read the docs
TI-2026-66157 Aliases CVE-2026-105043GHSA-j3v4-fmf2-7fmp

MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that…

Priority LOW 16CWE-451Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-451.

Summary

MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00119 1st percentileScored 2026-11-07
Fix Fixed Simulink (MathWorks): R2026b

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MathWorksSimulinkbefore R2026bR2026bPatch availableCNA
  • Simulink VendorMathWorks Affected before R2026b Fixed in R2026b Patch available CNA

Remediation

  • Fix · CNA Simulink (MathWorks) Fixed in R2026b

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-105043
  2. 2026-10-03 Alias added: GHSA-j3v4-fmf2-7fmp
  3. 2026-10-05 CISA SSVC decision points changed

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences