CVE-2025-40936 is an out-of-bounds read vulnerability affecting PS/IGES Parasolid Translator Component (all versions prior to V29.0.258) and Solid Edge (all versions prior to V226.00 Update 03). An attacker could exploit this by crafting a malicious IGS file, leading to application crashes or arbitrary code execution in the context of the current user. With a CVSS score of 7.8 (High), this vulnerability requires user interaction (UI:R) and local access (AV:L), but could result in high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). There is currently no public exploit code available, it is not listed in CISA KEV, and community discussion and media coverage are minimal, suggesting low active exploitation at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Siemens | PS/IGES Parasolid Translator Component | >= 0, < V29.0.258CNA affecteddefault unknown | |
| Siemens | Simcenter Femap | >= 0, < V2512.0003CNA affecteddefault unknown | |
| Siemens | Solid Edge | >= 0, < V226.00 Update 03CNA affecteddefault unknown |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.