CVE-2025-12659: IPT File Parsing RCE Vulnerability

CVE-2025-12659 Overview

CVE-2025-12659 is a heap-based memory corruption vulnerability triggered when affected applications parse specially crafted IPT files. An attacker who convinces a user to open a malicious IPT file can execute code in the context of the current process. The flaw is tracked under Zero Day Initiative identifiers ZDI-CAN-27349 and ZDI-CAN-27389 and is documented in Siemens Security Advisory SSA-870926. The weakness is classified as [CWE-122] Heap-based Buffer Overflow.

Critical Impact

Successful exploitation allows arbitrary code execution at the privilege level of the user opening the malicious IPT file, enabling attackers to compromise engineering workstations.

Affected Products

• Siemens product line referenced in advisory SSA-870926 (IPT file parser component)
• Engineering and design applications that process Inventor Part (.ipt) files
• Refer to the vendor advisory for the authoritative affected version list

Discovery Timeline

• Reported via - Trend Micro Zero Day Initiative (ZDI-CAN-27349, ZDI-CAN-27389)
• 2026-05-12 - CVE-2025-12659 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-12659

Vulnerability Analysis

The vulnerability resides in the routine responsible for parsing IPT files, a binary format used by computer-aided design software. When the parser processes a malformed IPT structure, it writes outside the bounds of a heap-allocated buffer. This corruption alters adjacent heap metadata or function pointers used later in execution flow.

An attacker who controls the contents of the heap-adjacent memory can redirect execution to attacker-supplied code. Because the affected application runs in user context, the resulting code execution inherits the user's privileges, including access to design assets, network shares, and credentials cached by the process.

The attack vector is local and requires user interaction. A victim must open the crafted IPT file, typically delivered through phishing, removable media, or compromised file shares used in engineering workflows.

Root Cause

The defect is a [CWE-122] heap buffer overflow. The parser fails to validate field lengths or record counts embedded in the IPT file before copying data into a fixed-size heap allocation. Crafted size fields cause the copy operation to exceed the allocated region.

Attack Vector

Exploitation requires delivering a malicious IPT file to a user of the affected application and convincing the user to open it. No network exposure is needed and no authentication is required on the target system. The complexity is elevated because reliable exploitation requires shaping the heap state of the target process.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose only; refer to the Siemens Security Advisory SSA-870926 for vendor-supplied technical details.

Detection Methods for CVE-2025-12659

Indicators of Compromise

• Unexpected crashes of the IPT file parser process, especially access violations referencing heap addresses
• IPT files arriving from untrusted email senders, external file shares, or removable drives
• Child processes spawned by the CAD application that are not part of normal engineering workflows, such as cmd.exe, powershell.exe, or rundll32.exe
• Outbound network connections initiated by the CAD application immediately after opening a document

Detection Strategies

• Monitor process creation events where the IPT-handling application is the parent of script interpreters or living-off-the-land binaries
• Apply YARA rules to scan IPT files at email and file-share boundaries for malformed headers or oversized length fields
• Alert on crash telemetry from the affected application that indicates heap corruption, including Windows Error Reporting events tied to the parser module

Monitoring Recommendations

• Centralize endpoint telemetry from engineering workstations and retain process, file, and network events for retrospective hunting
• Track file open events for .ipt files originating outside trusted project repositories
• Review user-initiated downloads of IPT attachments through email and web gateways

How to Mitigate CVE-2025-12659

Immediate Actions Required

• Apply the patch or updated version identified in Siemens Security Advisory SSA-870926 as soon as the vendor fix is available for your product release
• Restrict opening of IPT files to those sourced from trusted internal repositories and signed project pipelines
• Educate engineering staff to verify the origin of IPT attachments before opening them

Patch Information

Siemens publishes fixed versions and mitigation guidance through ProductCERT advisory SSA-870926. Consult the advisory for product-specific build numbers, download locations, and any conditional fixes. Until a patch is deployed, treat all externally sourced IPT files as untrusted.

Workarounds

• Block inbound .ipt file attachments at email gateways unless they originate from approved partners
• Use application allowlisting to prevent the CAD process from launching scripting hosts or shell binaries
• Open suspect IPT files only inside isolated virtual machines without access to production credentials or network shares

# Example: block IPT attachments at an email gateway and quarantine for review
# Adapt to your mail security platform's policy syntax
rule block_untrusted_ipt {
  match: attachment.extension == "ipt"
  and sender.domain not in trusted_partners
  action: quarantine, notify=secops@example.com
}