Overview
A high-severity vulnerability has been identified in Solid Edge SE2025, a popular 3D CAD, parametric feature, and synchronous technology solid modeling software. All versions before V225.0 Update 5 are affected. The vulnerability has the potential to compromise systems or lead to data leaks, making it a significant threat to businesses and individuals using the affected software.
The vulnerability, designated as CVE-2025-40740, lies in an out-of-bounds read past the end of an allocated structure while parsing specially crafted PAR files. Successful exploitation could allow an attacker to execute code in the context of the current process, leading to potential system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-40740
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Solid Edge SE2025 | All versions < V225.0 Update 5 How the Exploit Works
The exploit works by taking advantage of the out-of-bounds read vulnerability in the Solid Edge SE2025 software. Specifically, the software reads past the end of an allocated structure while parsing specially crafted PAR files. An attacker who understands how to craft these PAR files can manipulate the software into executing arbitrary code within the context of the current process. This could lead to a variety of unwanted outcomes, including system compromise or data leakage.
Conceptual Example Code
Though the exact details of exploiting this vulnerability are complex and beyond the scope of this article, a conceptual example of the exploit might involve a maliciously crafted PAR file like this:
// Malicious PAR file
BEGIN PAR
...
MALFORMED STRUCTURE OVERFLOWING ALLOCATED BOUNDS
...
END PARThe attacker would then need to get the user to open this malicious PAR file with the Solid Edge SE2025 software. The software, attempting to parse the malformed structure, would read past the end of its allocated bounds, potentially leading to code execution in the context of the current process.
Mitigation Guidance
Users of Solid Edge SE2025 are strongly encouraged to apply the vendor patch. Upgrading to Solid Edge SE2025 V225.0 Update 5 will remedy the vulnerability. If for any reason an immediate upgrade is not possible, employing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation strategy until the patch can be applied.