CVE-2025-40812: Siemens Solid Edge SE2024 RCE Vulnerability

CVE-2025-40812 Overview

Siemens disclosed CVE-2025-40812, an out-of-bounds read vulnerability [CWE-125] affecting Solid Edge SE2024 and Solid Edge SE2025. The flaw resides in the application's PRT file parser. An attacker can craft a malicious PRT file that, when opened by a victim, triggers a read past allocated memory bounds. Successful exploitation can crash the application or allow code execution in the context of the current user. The vulnerability requires local access and user interaction to open the malicious file. Siemens published the advisory on October 14, 2025 and addressed the issue in Solid Edge SE2024 V224.0 Update 14 and Solid Edge SE2025 V225.0 Update 6.

Critical Impact
Opening a crafted PRT file in an unpatched Solid Edge instance can lead to arbitrary code execution under the privileges of the current user.

Affected Products

Siemens Solid Edge SE2024 — all versions prior to V224.0 Update 14
Siemens Solid Edge SE2025 — all versions prior to V225.0 Update 6
PRT file parsing component shipped with both SE2024 and SE2025 releases

Discovery Timeline

2025-10-14 - CVE-2025-40812 published to NVD
2025-10-14 - Siemens publishes security advisory SSA-541582
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-40812

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the PRT file parser used by Solid Edge. PRT files are Solid Edge part files containing geometric and metadata structures consumed by the application at load time. When the parser processes a malformed PRT file, it reads memory outside the bounds of an allocated buffer.

The out-of-bounds read can disclose adjacent memory contents or corrupt parser state in ways that lead to code execution in the context of the current process. Because Solid Edge typically runs with the privileges of the logged-in engineer or designer, exploitation grants the attacker the same level of access on the workstation.

Exploitation requires user interaction. A victim must open the crafted PRT file, which can be delivered by email, shared via a CAD collaboration platform, or staged on a file share. Attack complexity is high because the attacker must shape the PRT structure to reach the vulnerable parsing path reliably.

Root Cause

The parser fails to validate that read offsets remain within allocated buffer bounds when processing fields in a specially crafted PRT file. Siemens has not published the affected function names. Refer to the Siemens Security Advisory SSA-541582 for vendor-supplied technical details.

Attack Vector

The attack vector is local with required user interaction. An attacker delivers a malicious PRT file to a target running an unpatched Solid Edge SE2024 or SE2025 installation. When the user opens the file, the parser dereferences out-of-bounds memory and the attacker controls execution within the Solid Edge process. The vulnerability cannot be triggered remotely without persuading the user to open the file.

No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-40812

Indicators of Compromise

Unexpected Solid Edge process crashes (Edge.exe or related modules) shortly after opening a PRT file from an external source
PRT files arriving from untrusted email senders, instant messaging, or unmanaged file shares
Child processes spawned by Solid Edge that are inconsistent with normal CAD workflows, such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections originating from the Solid Edge process to non-Siemens infrastructure

Detection Strategies

Monitor endpoint telemetry for Solid Edge process crashes correlated with recent PRT file access events
Inspect email and web gateway logs for inbound PRT attachments from external or unverified senders
Apply EDR behavioral rules that flag Solid Edge spawning shell interpreters or scripting hosts
Track file write events to PRT files in user document directories from non-Siemens processes

Monitoring Recommendations

Centralize Windows Application and Reliability event logs from engineering workstations to identify recurring Solid Edge faults
Alert on parent-child process anomalies where Solid Edge is the parent of a non-CAD binary
Maintain an inventory of installed Solid Edge versions and flag hosts running builds below V224.0 Update 14 (SE2024) or V225.0 Update 6 (SE2025)

How to Mitigate CVE-2025-40812

Immediate Actions Required

Upgrade Solid Edge SE2024 to V224.0 Update 14 or later
Upgrade Solid Edge SE2025 to V225.0 Update 6 or later
Instruct CAD users to open PRT files only from trusted, verified internal sources
Block PRT attachments from external senders at the email gateway until all workstations are patched

Patch Information

Siemens released fixed versions for both supported product lines. SE2024 users must install V224.0 Update 14, and SE2025 users must install V225.0 Update 6. Patch details and download instructions are available in the Siemens ProductCERT Advisory SSA-541582.

Workarounds

Avoid opening PRT files originating from untrusted or unverified sources
Use application allowlisting to restrict child processes that Solid Edge can launch
Segment engineering workstations from general corporate networks to limit lateral movement if a host is compromised
Run Solid Edge under standard user accounts rather than local administrator accounts to reduce post-exploitation impact

bash

# Verify installed Solid Edge build on a Windows workstation
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version" /s
# Confirm the reported version meets or exceeds:
#   SE2024: 224.0 Update 14
#   SE2025: 225.0 Update 6