Solid Edge CVE-2025-40809

Exploitation requires a victim to open a specially crafted PRT (Solid Edge part) file in a vulnerable Solid Edge installation (SE2024 < V224.0 Update 14 or SE2025 < V225.0 Update 6); the vulnerable code path is the PRT file parser. Key LIMITING factors: the attack is local/file-based (AV:L) with no remote network trigger, it mandates passive user interaction (UI:P) - opening the attacker-supplied file - and carries HIGH attack complexity (AC:H), meaning reliable code execution is difficult to achieve versus a mere crash. No special non-default product configuration is needed; any affected version parsing the malicious PRT is exposed.

This is a genuinely moderate, not critical, priority. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:P) and the 7.3 (High) score are driven by full C/I/A impact on the vulnerable system (VC:H/VI:H/VA:H), consistent with an out-of-bounds write (CWE-787) that can yield code execution. However, every exploitation-ease signal points downward: the vector is LOCAL (AV:L), attack complexity is HIGH (AC:H) reflecting the difficulty of turning an OOB write into reliable code execution, and passive user interaction (UI:P) is required - the victim must open a malicious PRT file. EPSS reinforces low real-world urgency at 0.14% (3rd percentile), and there is no CISA KEV listing and no public exploit identified, so no public exploit identified at time of analysis. The signals are internally consistent (local, user-interaction-dependent file-parsing bug with low exploitation probability) rather than conflicting. Note a nuance: PR:N labels this unauthenticated, but that is somewhat academic for a local file-open flaw - the real gating factor is social-engineering a user into opening a crafted file, not an authentication boundary. Net: patch within normal cycles; this is not a drop-everything emergency.

An attacker crafts a malicious Solid Edge PRT part file and delivers it to an engineer via email, a shared project repository, or a compromised supplier, relying on the victim to open it in a vulnerable Solid Edge version. When the file is parsed, the out-of-bounds write corrupts memory, crashing the application or potentially executing code in the context of the current user. No public exploit is known, and the HIGH attack complexity means weaponizing the OOB write into reliable code execution is non-trivial.