CVE-2025-40740: Out-of-bounds Read Vulnerability in Solid Edge SE2025

Overview

A high-severity vulnerability has been identified in Solid Edge SE2025, a popular 3D CAD, parametric feature, and synchronous technology solid modeling software. All versions before V225.0 Update 5 are affected. The vulnerability has the potential to compromise systems or lead to data leaks, making it a significant threat to businesses and individuals using the affected software.
The vulnerability, designated as CVE-2025-40740, lies in an out-of-bounds read past the end of an allocated structure while parsing specially crafted PAR files. Successful exploitation could allow an attacker to execute code in the context of the current process, leading to potential system compromise or data leakage.

Vulnerability Summary

CVE ID: CVE-2025-40740
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Solid Edge SE2025 | All versions < V225.0 Update 5 How the Exploit Works

The exploit works by taking advantage of the out-of-bounds read vulnerability in the Solid Edge SE2025 software. Specifically, the software reads past the end of an allocated structure while parsing specially crafted PAR files. An attacker who understands how to craft these PAR files can manipulate the software into executing arbitrary code within the context of the current process. This could lead to a variety of unwanted outcomes, including system compromise or data leakage.

Conceptual Example Code

Though the exact details of exploiting this vulnerability are complex and beyond the scope of this article, a conceptual example of the exploit might involve a maliciously crafted PAR file like this:

// Malicious PAR file
BEGIN PAR
...
MALFORMED STRUCTURE OVERFLOWING ALLOCATED BOUNDS
...
END PAR

The attacker would then need to get the user to open this malicious PAR file with the Solid Edge SE2025 software. The software, attempting to parse the malformed structure, would read past the end of its allocated bounds, potentially leading to code execution in the context of the current process.

Mitigation Guidance

Users of Solid Edge SE2025 are strongly encouraged to apply the vendor patch. Upgrading to Solid Edge SE2025 V225.0 Update 5 will remedy the vulnerability. If for any reason an immediate upgrade is not possible, employing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation strategy until the patch can be applied.