CVE-2026-73235 is an XXE vulnerability in FreeCAD's XML parsing that stems from a fundamental mismatch between Xerces-C++'s default configuration and what developers assumed the library provided. This is not a coding error in the conventional sense—it's a systemic failure where the library's security posture reflects 2003 XML specification compliance thinking rather than modern threat models.
The vulnerability exists in how FreeCAD instantiates Xerces-C++ to parse .FCStd files. Xerces-C++ enables external entity resolution by default, a decision made for XML spec compliance, not application security. When FreeCAD developers instantiated the XMLReader, they followed patterns that worked for legitimate documents—FCStd archives contain geometry data and thumbnails, not external entities. The attack surface is significant: .FCStd files are routinely exchanged between CAD users, making this exploitable through realistic social engineering rather than hypothetical upload scenarios.
The fix is a single property assignment. Disable external DTD loading and entity resolution in your Xerces parser configuration:
XMLPlatformUtils::Initialize();
XercesDOMParser parser = new XercesDOMParser();
parser->setFeature(XMLString::transcode("http://apache.org/xml/features/disallow-doctype-decl"), true);
parser->setFeature(XMLString::transcode("http://apache.org/xml/features/nonvalidating/load-external-dtd"), false);
parser->setProperty(XMLString::transcode("http://apache.org/xml/properties/internal/scanner/resolve-external-entities"), (void)false);
The Xerces documentation treats these security settings as opt-in enhancements rather than the correct default for untrusted input. This documentation gap creates predictable vulnerability patterns that static analysis tools consistently miss— scanners see valid XML parsing code, not a parsing decision that exposes filesystem contents.
The deeper issue: Xerces-C++ is effectively orphaned Apache infrastructure. The security-relevant defaults weren't decided recently—they were baked into 2003-era compliance thinking. When a library becomes abandoned but continues being embedded in downstream projects, its security assumptions rot silently. FreeCAD inherited invisible architectural debt.
Audit your codebase for other Xerces-C++ instantiation patterns. Search for XercesDOMParser and XMLReader usage. Every parsing path handling untrusted input should explicitly disable entity resolution—this should become a standard code review checkpoint for C++ XML libraries. The C++ ecosystem needs to recognize that 'default secure' for parsers means something fundamentally different than it did twenty years ago.