View CSAF
Summary
Solid Edge uses PS/IGES Parasolid Translator Component that contains an out of bounds read that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for Solid Edge and recommends to update to the latest version.
The following versions of Siemens Solid Edge are affected:
Solid Edge: All versions prior to V226.00 Update 03
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.8
Siemens
Siemens Solid Edge
Out-of-bounds Read
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2025-40936
The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)
View CVE Details
Affected Products
Siemens Solid Edge
Vendor: Siemens
Product Version: Solid Edge
Product Status: known_affected
Remediations
Vendor fix Update to V226.00 Update 03 or later version
Relevant CWE: CWE-125 Out-of-bounds Read
Metrics
CVSS Version
Base ...