Siemens Solid Edge Patch CVE-2025-40936 Update to V226.00 Update 03

Siemens has released an urgent security update for Solid Edge after researchers discovered an out‑of‑bounds read in the PS/IGES Parasolid Translator that can be triggered by specially crafted IGS files — a flaw Siemens tracks as CVE‑2025‑40936 — and the vendor is urging all customers to update to V226.00 Update 03 (or later) immediately to eliminate the risk of application crashes and possible arbitrary code execution. ([cert-portal.siemenortal.siemens.com/productcert/html/ssa-445819.html)

Background​

Solid Edge, Siemens’ mainstream mechanical CAD package, relies on a third‑party translator component (PS/IGES Parasolid Translator) to import and parse IGS (Initial Graphics Exchange Specification) files. On November 17, 2025 the vulnerability CVE‑2025‑40936 was published and assigned a high severity rating: CVSS v3.1 base score 7.8 (vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Siemens’ ProductCERT advisory describes the flaw as an out‑of‑bounds read during parsing of specially crafted IGS files that may let an attacker crash the app or execute code in the context of the current process.
The vulnerability disclosure was coordinated with the Trend Micro Zero Day Initiative (ZDI), which reported the issue to Siemens (ZDI‑CAN‑26755). Siemens published vendor remediation guidance and a fixed Solid Edge package, and national authorities such as CISA have republished vendor advisories to increase visibility to industrial operators.

---

What exactly is broken? A technical primer​

Out‑of‑bounds read (CWE‑125) in a file parser​

An out‑of‑bounds read occurs when software reads memory outside the buffer it is supposed to access. In file parsers this often arises from incorrect length fields, unchecked indices, or malformed data structures in an input file. When the parser reads past its allocated buffer, it can:

• Crash the process (denial of service).
• Read memory containing pointers or control data, potentially enabling further memory corruption chains.
• In some cases be combined with other issues to create arbitrary code execution.

CVE‑2025‑40936 specifically hits the Parasolid/IGES translator component used by Solid Edge while parsing IGS formatted files. Because the translator runs inside the Solid Edge process, any crash or corruption occurs in the same process context as the CAD application, elevating the business impact.

Where the attack surface lives​

• The attack vector is local file handling: a user must open (or be tricked into opening) a malicious IGS file within Solid Edge. CVSS vectors indicate user interaction required but no privileges required once a file is opened. That means the easiest exploitation path is social engineering (malicious email attachment, shared project archive, or third‑party component).
• The translator component versions noted in public records point to affected builds earlier than a vendor‑specified build threshold (for the translator itself: “All versions < V29.0.258” based on vendor reporting). Solid Edge installations shipping the older translator are susceptible until patched.

---

Who should care — threat model and likely targets​

Solid Edge is widely used in critical manufacturing and engineering workflows. The advisory explicitly calls out impact to critical manufacturing sectors and notes worldwide deployment. That makes the vulnerability relevant for:

• Mechanical and product engineering teams that routinely import customer or supplier CAD data.
• Engineering workstations connected to product data management (PDM) systems where uploaded IGS files can be previewed or opened.
• Shared project environments where files are exchanged between suppliers, integrators, and contractors.

Because the immediate attack path is opening a malicious file, every user who receives external IGS files is within scope. The risk profile rises sharply when design workstations have high privileges, network shares mounted that host PDM libraries, or when vendor maintenance procedures permit remote file transfer.

---

Exploitability, prevalence, and current threat state​

Multiple public tracking services and Siemens’ advisory align on severity but show low observed exploitation metrics:

• The CVSS v3.1 score from the vendor is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R. That reflects a local/adjacent attack vector with user interaction required.
• Public exploit‑prediction measures show a low likelihood of automated exploitation — e.g., EPSS / exploitation scoring for the CVE is very low (reported EPSS ~0.02% in public trackers). That doesn’t mean exploit code won’t appear, but it indicates limited current exploitation.
• No authoritative public reports of widespread exploitation were available at the time of the vendor advisory; Siemens and CISA focused on remediation and containment rather than reporting active incidents. Operators must treat the absence of public exploitation as not equivalent to safety — the necessary ingredients (file parsing + user interaction) are easy for attackers to assemble.

Bottom line: exploitability is straightforward in social‑engineering scenarios, but the immediate likelihood of mass exploitation appears low. That combination implies this should be prioritized in patch cycles and user‑training programs rather than ignored.

---

Vendor response and timeline​

Siemens released advisory SSA‑445819 on 2026‑02‑10 and recommends updating Solid Edge to V226.00 Update 03 or later. The vendor acknowledgement credits Trend Micro ZDI for coordinated disclosure. Siemens ProductCERT provides per‑product remediation instructions and directs customers to the support channels for update bundles and guidance. National agencies such as CISA republished the advisory to increase awareness for critical infrastructure operators.
Third‑party vulnerability aggregators (NVD, CVE listings, CVE Details) have created records for CVE‑2025‑40936 that mirror the vendor’s technical description and scoring. These public records provide convenient cross‑reference for security teams performing triage and vulnerability management.

---

Practical mitigation: step‑by‑step playbook​

Below is a practical, prioritized remediation and containment playbook tailored for IT and security teams managing Solid Edge installations.

• Immediate patching (highest priority)
• Identify all Solid Edge installations and record version strings and translator component versions.
• Schedule and install Solid Edge V226.00 Update 03 (or later) on workstations used for design, engineering, and PDM servers. Prioritize high‑risk hosts (those with internet access, vendor access, or exposed file shares).
• Validate patch success by confirming application version and performing controlled file import tests.
• Interim compensations if patching cannot be immediate
• Block IGS/IGES file uploads and attachments at email gateway and file transfer services.
• Configure endpoint file‑type blocking or prompt policies to prevent automatic opening of .igs/.iges files.
• Require opening external IGS files only within an isolated VM or sandbox environment.
• Restrict PDM systems to accept only vetted file formats and enforce virus/metadata scanning on intake.
• Hardening and least privilege
• Ensure design workstation users run with non‑administrative privileges.
• Use application allow‑listing so only approved CAD binaries execute on engineering endpoints.
• Disable unnecessary translator plugin components if vendor documentation permits.
• Network segmentation and access controls
• Place engineering workstations and PDM servers behind segmented VLANs and limit outbound access.
• Restrict remote maintenance and vendor VPNs with least‑privilege jump hosts and multi‑factor authentication.
• Block direct internet access from engineering hosts where possible. These are standard ICS/OT recommendations reiterated by CISA and Siemens.
• Detection and monitoring
• Monitor endpoint telemetry for unexplained Solid Edge process crashes, new child processes, or processes spawning shells.
• Look for anomalous file system writes in directories where Solid Edge stores temporary imports.
• Correlate email and file transfer logs with workstation process events — an uptick in crashes tied to recent file receipts is a red flag.
• Communication and training
• Notify engineering staff and contractors about the risk and instruct them not to open unsolicited IGS files.
• Update change‑control procedures for importing external CAD data — include scanning, quarantine, and validation steps.
• Incident readiness
• Prepare an incident playbook that includes isolation of suspected compromised workstations, preserving memory/process dumps for forensic analysis, and contacting Siemens ProductCERT if exploitation is suspected.

---

Detection and forensic guidance​

Because the flaw manifests during parsing, detection often begins with crash‑based signals:

• Repeated Solid Edge crashes while opening IGS files or previewing models.
• Core dumps or abnormal exit codes from Solid Edge processes.
• New, unexpected child processes launched by the Solid Edge process (a sign of code execution).
• Sudden unauthorized network activity originating from engineering workstations shortly after file imports.

Forensics steps:

• Preserve volatile memory (process memory dumps) of a crashed Solid Edge process for analysis.
• Collect copies of the IGS files that triggered crashes and apply safe parsing in controlled environments or with updated parsing tools to observe behavior.
• Review EDR logs for commands or DLL loads that coincide with the crash timeframe.

Note: At the time of publication, there are no public exploit samples tied to this CVE; however, memory dumps and preserved file samples help vendors and forensic teams confirm exploitation and support patch validation.

---

Why this class of vulnerability matters in engineering and OT environments​

CAD workstations often sit at the intersection of corporate IT and operational engineering: they host intellectual property, connect to PDM and PLM systems, and sometimes have elevated access to manufacturing execution pipelines. A successful code execution on a design workstation could lead to:

• Intellectual property theft (design files exfiltrated).
• Lateral movement into PDM/PLM servers or build systems.
• Tampering with CAD models and BOMs (supply chain manipulation).
• Introduction of malicious artifacts that propagate into manufacturing processes.

Because many industrial and manufacturing environments operate under strict availability and integrity constraints, the risk of even a brief compromise is nontrivial. This is why Siemens and CISA emphasize patching, network segmentation, and following industrial security operational guidance.

---

Strengths and limitations of the vendor and public response​

Strengths​

• Siemens released a targeted advisory and a fixed Solid Edge build quickly after coordinated disclosure; ProductCERT remains the authoritative source with per‑product guidance. The advisory credits ZDI for coordinated reporting, reflecting responsible disclosure practices.
• National agencies (CISA) have republished vendor advisories to increase visibility for industrial operators and urged defensive measures suited to OT environments.
• Public CVE/NVD/CVE Details entries provide accessible reference data for vulnerability managers integrating the issue into vulnerability scanners and patch tracking workflows.

Limitations and residual risks​

• The vulnerability requires user interaction to trigger, meaning human factors remain the primary risk vector; patching reduces but does not eliminate risk from legacy or unpatched endpoints.
• Many engineering teams accept external CAD input from partners and suppliers as part of normal workflow; enforcing strict quarantine or sandboxing may clash with operational cadence unless planned carefully.
• Some users (community editions or out‑of‑maintenance installations) may face friction obtaining vendor patches or downloads; helpdesk and maintenance contracts become critical in such cases. Community reporting in public forums has highlighted access friction to certain patches in past releases.

---

Recommended timeline for remediation (90‑day plan)​

• Days 0–7: Triage and containment
• Inventory Solid Edge installations.
• Apply vendor patch to a pilot group of high‑risk hosts and validate.
• Block IGS file attachments at email gateway and require quarantined handling for incoming CAD files.
• Days 8–30: Enterprise rollout and hardening
• Deploy patched Solid Edge to all engineering workstations.
• Implement sandboxing processes for any remaining unpatched hosts.
• Enforce least privilege and application allow‑listing on engineering endpoints.
• Days 31–90: Monitoring, process changes, and supply chain controls
• Integrate file‑type scanning and validation into PDM intake workflows.
• Update vendor and contractor onboarding to require secure file transfer mechanisms.
• Conduct tabletop exercises for CAD‑related compromise scenarios.

This cadence balances operational continuity with the urgency of remediation and mirrors recommendations from Siemens and national bodies for phased mitigation and defense‑in‑depth.

---

Final analysis and risk summary​

CVE‑2025‑40936 is a high‑severity vulnerability in a widely used CAD import component. The technical mechanics — an out‑of‑bounds read in a file parser — are well‑understood and have historically been a frequent route to code execution when weaponized. However, the immediate exploitability is mitigated somewhat by the need for user interaction and the currently low public exploitation metrics. That said, the most realistic attacker scenario is straightforward: craft a malicious IGS file, deliver it to an engineer via email or shared drive, and rely on social engineering to have the file opened.
Security teams should treat this as a high‑priority patching task for Solid Edge installations, combined with compensating controls where immediate patching is impractical. The vendor fix (V226.00 Update 03 or later) is the definitive remediation; follow‑on measures include sandboxing, file gating, and network segmentation to reduce the overall attack surface.
Key actionable items:

• Patch Solid Edge to V226.00 Update 03 (or later) immediately where available.
• Block or quarantine incoming IGS files until validated.
• Harden engineering endpoints with least privilege, allow‑listing, and segmentation.
• Monitor for unusual Solid Edge crashes and collect artifacts for forensic analysis if exploitation is suspected.

Operators should consult Siemens ProductCERT for exact remediation bundles and per‑SKU guidance, and follow industrial cybersecurity best practices as reiterated by national agencies such as CISA. Treat the advisory as an urgent patch‑and‑mitigate situation — not merely an informational bulletin.

---

This article has summarized the technical nature of CVE‑2025‑40936 and provided an operationally focused mitigation roadmap for Solid Edge users and enterprise teams; it cross‑references Siemens’ ProductCERT advisory, public CVE/NVD records, and national guidance to help security teams prioritize action.

---

Source: CISA Siemens Solid Edge | CISA