CVE-2025-40810: Siemens Solid Edge SE2024 RCE Vulnerability

CVE-2025-40810 Overview

CVE-2025-40810 is an out-of-bounds write vulnerability [CWE-787] in Siemens Solid Edge that occurs when the application parses specially crafted PRT files. The flaw affects Solid Edge SE2024 versions prior to V224.0 Update 14 and Solid Edge SE2025 versions prior to V225.0 Update 6. An attacker who convinces a user to open a malicious PRT file can crash the application or execute arbitrary code in the context of the current process. The issue requires local file access and user interaction, limiting remote exploitation but making targeted social engineering attacks practical against engineering and design workstations.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the Solid Edge process, enabling attackers to compromise CAD workstations holding sensitive intellectual property.

Affected Products

Siemens Solid Edge SE2024 (All versions < V224.0 Update 14)
Siemens Solid Edge SE2025 (All versions < V225.0 Update 6)
PRT file parsing component in affected Solid Edge releases

Discovery Timeline

2025-10-14 - CVE-2025-40810 published to NVD
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-40810

Vulnerability Analysis

The vulnerability resides in the PRT file parser bundled with Siemens Solid Edge. PRT files are the native part file format used by Solid Edge to describe 3D models, features, and assembly metadata. When the parser processes a malformed PRT file, it writes data past the bounds of an allocated buffer, corrupting adjacent memory.

Out-of-bounds writes of this class typically allow attackers to overwrite control data such as function pointers, virtual table references, or heap metadata. Once attacker-controlled values reach a control-flow primitive, code execution in the context of the Solid Edge process becomes feasible. Because Solid Edge typically runs with the privileges of the logged-in engineer, exploitation grants access to design files, network shares, and credentials available to that user.

Root Cause

The defect is classified as [CWE-787] Out-of-Bounds Write. The PRT parser does not adequately validate field sizes or offsets contained in the file before writing parsed data into memory buffers. Crafted inputs cause the writer to exceed buffer boundaries during deserialization of geometry or metadata structures.

Attack Vector

Exploitation requires local file delivery and user interaction. An attacker distributes a malicious PRT file through phishing, supplier collaboration portals, compromised file shares, or third-party design exchanges. When an engineer opens the file in a vulnerable Solid Edge build, the parser triggers the out-of-bounds write. No network exposure or elevated privileges are required prior to exploitation, but the user must consent to opening the document.

The vulnerability cannot be reached over the network without user action, which constrains mass exploitation but aligns with targeted intrusions against manufacturing, defense, and aerospace supply chains.

No public proof-of-concept exploit is currently associated with this CVE, and it is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-40810

Indicators of Compromise

Unexpected crashes or Windows Error Reporting events generated by Edge.exe or related Solid Edge processes during PRT file open operations
PRT files arriving from untrusted email senders, external supplier portals, or unfamiliar cloud share links
Solid Edge processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by Solid Edge processes immediately after opening a part file

Detection Strategies

Monitor process lineage for Solid Edge spawning script interpreters or living-off-the-land binaries, which is uncharacteristic of legitimate CAD workflows
Inspect crash dumps and application error logs for access violations within PRT parsing modules
Apply file inspection at email and web gateways to flag PRT attachments from external senders for analyst review

Monitoring Recommendations

Maintain an inventory of Solid Edge installations and their patch level using endpoint configuration management
Alert on file write operations placing PRT files in user-writable directories shortly before Solid Edge launches
Capture endpoint telemetry, including image loads and memory protection changes within the Solid Edge process, for retrospective hunting

How to Mitigate CVE-2025-40810

Immediate Actions Required

Upgrade Solid Edge SE2024 to V224.0 Update 14 or later
Upgrade Solid Edge SE2025 to V225.0 Update 6 or later
Restrict opening of PRT files received from external or untrusted sources until patches are applied
Verify patch deployment status across all engineering workstations and remediate stragglers

Patch Information

Siemens published advisory SSA-541582 addressing CVE-2025-40810. The fix is delivered in Solid Edge SE2024 V224.0 Update 14 and Solid Edge SE2025 V225.0 Update 6. Customers should obtain the updates from the Siemens download portal and validate installation across all design workstations.

Workarounds

Only open PRT files originating from trusted sources and verified internal repositories
Train engineering staff to treat unsolicited CAD attachments as suspicious, mirroring guidance applied to Office documents
Run Solid Edge under standard user accounts rather than local administrators to limit post-exploitation impact
Segment CAD workstations from sensitive production systems and intellectual property repositories where feasible

bash

# Verify installed Solid Edge version on Windows endpoints
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version" /s

# Block PRT attachments at the mail gateway (example Exchange transport rule)
New-TransportRule -Name "Block-External-PRT" `
  -FromScope NotInOrganization `
  -AttachmentExtensionMatchesWords "prt" `
  -RejectMessageReasonText "External PRT attachments are blocked pending review"