CVE-2025-40740: Siemens Solid Edge RCE Vulnerability

CVE-2025-40740 Overview

CVE-2025-40740 is an out-of-bounds read vulnerability affecting Siemens Solid Edge SE2025 in all versions prior to V225.0 Update 5. The flaw resides in the PAR file parser, which reads past the end of an allocated structure when processing specially crafted PAR files. Successful exploitation allows an attacker to execute code in the context of the current process. The issue is tracked under CWE-125: Out-of-bounds Read and was disclosed by Siemens in advisory SSA-091753.

Critical Impact
An attacker can achieve arbitrary code execution in the user's context by convincing a Solid Edge user to open a malicious PAR file.

Affected Products

Siemens Solid Edge SE2025 (all versions prior to V225.0 Update 5)
Siemens Solid Edge SE2025 Update 1 through Update 4
Siemens Solid Edge SE2025 base release

Discovery Timeline

2025-07-08 - CVE CVE-2025-40740 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40740

Vulnerability Analysis

The vulnerability stems from improper bounds checking in the PAR file parsing routines used by Solid Edge SE2025. PAR files are the native part-file format used to describe 3D solid and surface geometry within Solid Edge. When the parser processes a malformed PAR file, it reads memory past the end of an allocated structure. This out-of-bounds read condition exposes adjacent process memory and can be leveraged by an attacker to influence control flow. According to the Siemens advisory, the resulting condition is sufficient for code execution in the context of the current process. The bug requires user interaction because the malicious file must be opened by a Solid Edge user.

Root Cause

The root cause is missing or insufficient validation of length and offset fields within the PAR file structure. The parser trusts attacker-controlled size metadata when accessing fields inside or immediately following an allocated buffer. This is a classic CWE-125 condition where a read operation crosses the boundary of the allocated object.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious .par file and delivers it to a victim through phishing, a shared file repository, or a supply chain channel. When the user opens the file in Solid Edge SE2025, the vulnerable parser dereferences memory beyond the allocated structure. Exploitation does not require elevated privileges, and code executes with the rights of the Solid Edge user. Refer to the Siemens Security Advisory SSA-091753 for additional vendor technical detail.

Detection Methods for CVE-2025-40740

Indicators of Compromise

Unexpected .par files received via email attachments, external storage, or untrusted network shares.
Crashes, exceptions, or abnormal termination of SolidEdge.exe or related Solid Edge processes during file open operations.
Child processes spawned by Solid Edge that are inconsistent with normal CAD workflows (for example, cmd.exe, powershell.exe, or scripting hosts).

Detection Strategies

Monitor process creation events where Solid Edge binaries spawn command interpreters or network-capable utilities.
Inspect endpoint telemetry for memory access violations and crash dumps originating from Solid Edge PAR parsing modules.
Apply YARA or content-inspection rules at email and web gateways to flag PAR files originating from external or low-reputation sources.

Monitoring Recommendations

Track Solid Edge version inventory across engineering workstations to confirm all hosts run V225.0 Update 5 or later.
Forward endpoint and EDR telemetry to a centralized SIEM or data lake to correlate file open events, process lineage, and post-exploitation behavior.
Alert on outbound network connections initiated by Solid Edge processes shortly after PAR file open events.

How to Mitigate CVE-2025-40740

Immediate Actions Required

Upgrade Siemens Solid Edge SE2025 to V225.0 Update 5 or later on all engineering workstations.
Restrict opening of PAR files to those originating from trusted internal sources and verified business partners.
Educate CAD users on the risk of opening unsolicited or externally sourced part files.

Patch Information

Siemens has released Solid Edge SE2025 V225.0 Update 5, which remediates the out-of-bounds read in the PAR file parser. Detailed patch and download guidance is published in the Siemens Security Advisory SSA-091753. Administrators should validate the installed version using the Solid Edge About dialog or by checking the installed package metadata before clearing this finding.

Workarounds

Avoid opening PAR files received from untrusted or unverified sources until patching is complete.
Operate Solid Edge under standard user accounts rather than local administrators to limit the impact of code execution.
Apply application allow-listing and attachment filtering policies that quarantine PAR files from external email senders.

bash

# Verify installed Solid Edge version on Windows
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version" /s
# Confirm the reported version is V225.0 Update 5 or later