CVE-2025-40739: Siemens Solid Edge RCE Vulnerability

CVE-2025-40739 Overview

CVE-2025-40739 is an out-of-bounds read vulnerability in Siemens Solid Edge SE2025, affecting all versions prior to V225.0 Update 5. The flaw occurs when the application parses specially crafted PAR files, reading memory past the end of an allocated structure. An attacker can leverage this condition to execute code in the context of the current process. Exploitation requires local file access and user interaction to open the malicious PAR file. The vulnerability is tracked under CWE-125: Out-of-bounds Read and is documented in Siemens Security Advisory SSA-091753.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the Solid Edge process on engineering workstations.

Affected Products

Siemens Solid Edge SE2025 (base release)
Siemens Solid Edge SE2025 Updates 1 through 4
All Solid Edge SE2025 versions prior to V225.0 Update 5

Discovery Timeline

2025-07-08 - CVE CVE-2025-40739 published to NVD
2025-08-21 - Last updated in NVD database

Technical Details for CVE-2025-40739

Vulnerability Analysis

The vulnerability resides in the PAR file parsing logic within Solid Edge SE2025. PAR files store Solid Edge part geometry and associated metadata. When the parser processes a crafted PAR file, it reads beyond the bounds of an allocated structure. This out-of-bounds read exposes adjacent memory and can corrupt program control flow when the disclosed data feeds into subsequent operations. An attacker who controls the layout of the malicious file can chain the read primitive to bypass memory protections and achieve code execution. The flaw executes with the privileges of the user running Solid Edge, which typically includes access to CAD source files, intellectual property, and network shares used by engineering teams.

Root Cause

The root cause is missing bounds validation during the deserialization of structured data within PAR files. The parser trusts size and offset fields embedded in the file and dereferences memory past the end of the allocated buffer. This pattern matches [CWE-125], where an upstream length check is either absent or incorrectly computed.

Attack Vector

The attack requires an attacker to deliver a crafted PAR file to a target user, for example via email, shared engineering folders, or supply chain compromise of a CAD component library. The user must open the file in a vulnerable Solid Edge SE2025 installation. No network exposure is required, and no prior authentication to the host is needed beyond what the victim already has.

No verified public exploit code is available. See Siemens Security Advisory SSA-091753 for vendor technical details.

Detection Methods for CVE-2025-40739

Indicators of Compromise

Unexpected crashes or Watson error reports generated by Edge.exe or related Solid Edge processes shortly after opening a PAR file
PAR files arriving from untrusted sources, external email, or unexpected network shares
Child processes spawned by Solid Edge that are not part of normal CAD workflows, such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by the Solid Edge process to non-Siemens infrastructure

Detection Strategies

Inventory all endpoints running Solid Edge SE2025 and compare installed versions against V225.0 Update 5 or later
Hunt for process lineage where Solid Edge spawns scripting interpreters or LOLBins
Apply YARA or file-type heuristics to flag PAR files attached to inbound email or written to user Downloads directories
Correlate Solid Edge crash telemetry with file-open events to surface exploitation attempts

Monitoring Recommendations

Enable command-line and process-creation logging on engineering workstations through Sysmon or equivalent EDR telemetry
Forward Solid Edge application crash events from the Windows Application log to a central SIEM for analysis
Monitor file shares used by engineering teams for newly written PAR files originating from unusual user accounts
Track Solid Edge network egress and alert on connections outside of approved licensing and update endpoints

How to Mitigate CVE-2025-40739

Immediate Actions Required

Upgrade Solid Edge SE2025 to V225.0 Update 5 or later on every affected workstation
Restrict PAR file handling to files originating from trusted internal sources until patching is complete
Educate CAD engineers on the risk of opening PAR files received via email or downloaded from untrusted locations
Audit shared engineering directories for unauthorized PAR files and remove any suspicious artifacts

Patch Information

Siemens has released Solid Edge SE2025 V225.0 Update 5, which remediates CVE-2025-40739. Download the fixed release through standard Siemens distribution channels. Refer to Siemens Security Advisory SSA-091753 for the authoritative fix matrix and download links.

Workarounds

Do not open PAR files from untrusted or unverified sources
Apply application allowlisting to prevent Solid Edge from launching child processes such as command interpreters
Run Solid Edge under a standard user account to limit the impact of code execution within the process context
Segment engineering workstations from general corporate networks to contain post-exploitation movement

bash

# Verify installed Solid Edge version on Windows
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version 225\Current Version" /v Version