CVE-2025-40936: Siemens Parasolid IGS RCE Vulnerability

CVE-2025-40936 Overview

CVE-2025-40936 is an out-of-bounds read vulnerability [CWE-125] in the Siemens PS/IGES Parasolid Translator Component, Simcenter Femap, and Solid Edge. The flaw occurs when the affected applications parse specially crafted IGS (Initial Graphics Exchange Specification) files. An attacker who convinces a user to open a malicious IGS file can crash the application or execute code in the context of the current process. The issue was reported through the Zero Day Initiative (ZDI-CAN-26755).

Critical Impact
Successful exploitation enables arbitrary code execution in the context of the affected engineering application, potentially compromising intellectual property and design workstations used in industrial and manufacturing environments.

Affected Products

PS/IGES Parasolid Translator Component (all versions prior to V29.0.258)
Simcenter Femap (all versions prior to V2512.0003)
Solid Edge (all versions prior to V226.00 Update 03)

Discovery Timeline

2025-11-17 - CVE-2025-40936 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40936

Vulnerability Analysis

The vulnerability resides in the IGS file parser shared by the Siemens PS/IGES Parasolid Translator Component and its consuming products, Simcenter Femap and Solid Edge. IGS is a legacy CAD interchange format containing structured records that describe geometry, topology, and metadata. The parser reads past the bounds of an allocated buffer when processing malformed records inside a crafted IGS file. This out-of-bounds read [CWE-125] leaks adjacent heap or stack memory into program logic and, depending on the corrupted values consumed downstream, can drive control-flow decisions that ultimately allow arbitrary code execution. Exploitation requires user interaction: a target must open the malicious file in an affected application. Attack complexity is elevated because the attacker cannot directly influence memory layout on the victim's workstation.

Root Cause

The root cause is missing or insufficient bounds validation when the IGES translator reads variable-length fields or indexed entries from the parameter and directory sections of an IGS file. When length or index values in the file exceed the allocated buffer size, the parser dereferences memory beyond the intended object.

Attack Vector

The attack vector is local and requires user participation. An attacker delivers a weaponized .igs or .iges file through email, a shared engineering repository, a supplier exchange portal, or a compromised file share. When an engineer opens the file in Solid Edge, Simcenter Femap, or any application that loads the PS/IGES Parasolid Translator Component, the parser processes the malicious records and triggers the out-of-bounds read.

No verified public exploit code is available. The vulnerability manifests during IGS parsing; see the referenced Siemens ProductCERT advisories for technical specifics.

Detection Methods for CVE-2025-40936

Indicators of Compromise

Unexpected crashes or Watson error reports from SolidEdge.exe, femap.exe, or processes loading the PS/IGES Parasolid Translator DLLs shortly after opening an IGS file.
IGS or IGES files arriving from untrusted external sources, especially with anomalous file sizes or malformed section markers.
Child processes spawned by CAD applications immediately after loading an IGS file, such as cmd.exe, powershell.exe, or unsigned binaries.

Detection Strategies

Monitor endpoints running Siemens CAD software for process crashes correlated with file open events targeting .igs or .iges extensions.
Alert on CAD application processes making outbound network connections or writing executable files after opening a document.
Inspect email and file-transfer gateways for IGS attachments from external senders and quarantine for sandbox analysis.

Monitoring Recommendations

Enable process creation and image load logging on engineering workstations and forward events to a centralized analytics platform.
Track loads of the Parasolid translator libraries against a baseline to identify anomalous invocation contexts.
Correlate file access telemetry with subsequent process behavior to flag exploitation attempts against CAD parsers.

How to Mitigate CVE-2025-40936

Immediate Actions Required

Upgrade PS/IGES Parasolid Translator Component to V29.0.258 or later.
Upgrade Simcenter Femap to V2512.0003 or later.
Upgrade Solid Edge to V226.00 Update 03 or later.
Restrict opening of IGS files to those originating from trusted internal sources or verified suppliers.

Patch Information

Siemens has released fixed versions for each affected product. Refer to the vendor advisories for detailed patch and download instructions: Siemens Security Advisory SSA-241605, Siemens Security Advisory SSA-445819, and Siemens Security Advisory SSA-870926.

Workarounds

Do not open IGS or IGES files received from untrusted or unverified sources.
Process externally supplied CAD files inside isolated virtual machines or sandboxed environments with no network access to production assets.
Apply application allowlisting to prevent CAD processes from spawning shells, scripting hosts, or unsigned binaries.
Enforce least-privilege user accounts on engineering workstations to limit the impact of code execution in the CAD process context.

bash

# Example: block CAD applications from spawning script interpreters via Windows Defender Application Control or AppLocker
# AppLocker rule concept (executed in an elevated PowerShell prompt)
New-AppLockerPolicy -RuleType Path -User Everyone \
  -Action Deny \
  -Path "%SYSTEMROOT%\System32\cmd.exe" \
  -Description "Deny cmd.exe when parent is SolidEdge.exe or femap.exe"