In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.
History

Fri, 08 May 2026 21:45:00 +0000

Type Values Removed Values Added
Title Arbitrary Code Execution via Malformed 3MF File in PrusaSlicer

Fri, 08 May 2026 20:30:00 +0000

Type Values Removed Values Added
Title Execution of arbitrary code via malicious 3mf file in PrusaSlicer
Weaknesses CWE-78

Fri, 08 May 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 08 May 2026 06:45:00 +0000

Type Values Removed Values Added
Title Execution of arbitrary code via malicious 3mf file in PrusaSlicer
Weaknesses CWE-78

Fri, 08 May 2026 05:45:00 +0000

Type Values Removed Values Added
Description In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-05-08T17:07:37.996Z

Reserved: 2023-11-05T00:00:00.000Z

Link: CVE-2023-47268

cve-icon Vulnrichment

Updated: 2026-05-08T17:06:52.978Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-08T06:16:08.667

Modified: 2026-05-08T18:16:31.393

Link: CVE-2023-47268

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-08T21:30:05Z