CVE-2025-40936

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-17 · updated 2026-10-23
Weakness: CWE-125

Description

A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Simcenter Femap (All versions < V2512.0003), Solid Edge (All versions < V226.00 Update 03). The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)

Affected products

Siemens PS/IGES Parasolid Translator Component: before V29.0.258 — fixed in V29.0.258
Siemens Simcenter Femap: before V2512.0003 — fixed in V2512.0003
Siemens Solid Edge: before V226.00 Update 03 — fixed in V226.00 Update 03

How to fix

Upgrade to a fixed version: Siemens PS/IGES Parasolid Translator Component V29.0.258; Siemens Simcenter Femap V2512.0003; Siemens Solid Edge V226.00 Update 03. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-40936 or the next vulnerability affects your stack