CVE-2025-40811: Siemens Solid Edge Se2024 RCE Vulnerability

CVE-2025-40811 Overview

CVE-2025-40811 is an out-of-bounds read vulnerability [CWE-125] in Siemens Solid Edge, a computer-aided design (CAD) application. The flaw exists in the PRT file parser. Attackers can craft a malicious PRT file that, when opened by a victim, causes the application to read memory outside the bounds of an allocated buffer. This can crash Solid Edge or allow code execution in the context of the current process. The vulnerability requires user interaction and local file access, making weaponized CAD files delivered via email or shared file repositories the primary attack path.

Critical Impact
Successful exploitation can lead to arbitrary code execution within the Solid Edge process, compromising design data and the workstation running the engineering software.

Affected Products

Siemens Solid Edge SE2024 — all versions prior to V224.0 Update 14
Siemens Solid Edge SE2025 — all versions prior to V225.0 Update 6
PRT file parsing component shared by both product lines

Discovery Timeline

2025-10-14 - CVE-2025-40811 published to NVD with Siemens advisory SSA-541582
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-40811

Vulnerability Analysis

The vulnerability resides in the PRT file parsing logic of Solid Edge SE2024 and SE2025. PRT files are proprietary CAD part files containing geometric and metadata structures. When Solid Edge parses a specially crafted PRT file, the parser reads data beyond the bounds of an allocated buffer. This condition is classified under [CWE-125] Out-of-Bounds Read.

The out-of-bounds read can leak adjacent process memory or corrupt control flow when the read value is used as a pointer, index, or length field downstream. According to Siemens advisory SSA-541582, exploitation can result in either an application crash or code execution in the context of the user running Solid Edge. Engineering workstations typically have access to intellectual property repositories, source CAD data, and product lifecycle management systems, increasing the impact of a successful compromise.

Root Cause

The root cause is insufficient bounds validation when parsing untrusted PRT file structures. The parser trusts size or offset fields embedded in the file without verifying they remain within the allocated buffer. Crafted values cause reads past the buffer end, exposing memory or producing values that destabilize subsequent processing.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious PRT file through email attachments, shared network drives, USB media, or compromised CAD collaboration platforms. The victim opens the file in Solid Edge, triggering the vulnerable parser. No elevated privileges are required, and the attacker gains code execution at the privilege level of the logged-on engineer.

The vulnerability is described in prose only as no public proof-of-concept exploit has been released. Refer to the Siemens Security Advisory SSA-541582 for vendor technical details.

Detection Methods for CVE-2025-40811

Indicators of Compromise

Unexpected Solid Edge process crashes (Edge.exe) coinciding with opening a PRT file from an external source
PRT files received from untrusted senders or downloaded from non-corporate file shares
Child processes spawned by Solid Edge that are inconsistent with normal CAD workflows, such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by the Solid Edge process to non-Siemens infrastructure

Detection Strategies

Monitor endpoint telemetry for abnormal process trees originating from Solid Edge executables
Alert on Windows Error Reporting (WER) entries or application crash events for Solid Edge with access violation exceptions
Inspect email gateway and file share logs for .prt attachments from external sources
Correlate file open events on PRT files with subsequent suspicious process or network activity

Monitoring Recommendations

Enable detailed process creation auditing (Event ID 4688) and command-line logging on engineering workstations
Capture Solid Edge crash dumps for forensic analysis when the process terminates unexpectedly
Track PRT file provenance using file integrity monitoring on shared CAD repositories

How to Mitigate CVE-2025-40811

Immediate Actions Required

Upgrade Solid Edge SE2024 to V224.0 Update 14 or later
Upgrade Solid Edge SE2025 to V225.0 Update 6 or later
Instruct engineers not to open PRT files received from untrusted sources or unsolicited email
Restrict write access to internal CAD repositories to authorized engineering accounts only

Patch Information

Siemens has released fixed versions addressing CVE-2025-40811. Apply Solid Edge SE2024 V224.0 Update 14 or Solid Edge SE2025 V225.0 Update 6. Patch details and download instructions are available in the Siemens Security Advisory SSA-541582.

Workarounds

Only open PRT files from trusted, verified sources
Use file reputation and sandboxing controls on email gateways to inspect inbound CAD attachments
Run Solid Edge under a standard user account to limit the impact of code execution
Segment engineering workstations from sensitive production and intellectual property systems

bash

# Verify installed Solid Edge version on Windows
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version 224.0" /v Version
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version 225.0" /v Version

# Block inbound .prt attachments at the mail gateway (example PowerShell rule)
New-TransportRule -Name "Block-PRT-Attachments" \
  -AttachmentExtensionMatchesWords "prt" \
  -RejectMessageReasonText "PRT attachments blocked pending CAD review."