Solid Edge CVE-2025-40811

Exploitation requires the victim to open an attacker-supplied, specially crafted PRT (Solid Edge part) file in a vulnerable Solid Edge installation (SE2024 before V224.0 Update 14, or SE2025 before V225.0 Update 6). There is no remote or network-triggerable path: the flaw is in the client-side PRT file parser, so the attacker must socially engineer or otherwise induce a user to open the malicious file. Limiting factors that reduce realistic risk: mandatory user interaction (UI:P), local attack vector (no network service exposure), high attack complexity per the vendor (AC:H), and the fact that an out-of-bounds read most often produces a crash or memory disclosure rather than reliable code execution. No special product configuration is needed beyond running an affected version with default file-handling behavior.

This is a moderate-severity, low-urgency issue despite its 7.3 CVSS 4.0 score. The vendor-provided CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) is self-consistent and points to a file-parsing flaw rather than a remotely reachable service: exploitation is local (AV:L), requires user interaction (UI:P - the victim must open a malicious PRT file), and is rated high attack complexity (AC:H), all of which substantially lower real-world risk even though the technical impact is high (full C/I/A on the vulnerable system). The EPSS score of 0.14% (3rd percentile) is very low and is consistent with the absence of KEV listing and no identified public exploit - there is no signal of opportunistic or widespread exploitation. CWE-125 (out-of-bounds read) typically yields a crash or information disclosure far more readily than reliable code execution; the vendor's 'or execute code' language describes a possibility, not a demonstrated capability. All signals align in the same direction (hard-to-exploit, user-interaction-dependent, no exploitation activity), so there is no conflict to flag beyond noting that reliable code execution from an OOB read is not independently confirmed. This is a patch-in-normal-cycle item, not an emergency.

An attacker crafts a malicious PRT (part) file and delivers it to a Solid Edge user via email, a shared engineering repository, or a supply-chain document exchange. When the engineer opens the file, the out-of-bounds read during parsing crashes the application or, in the best case for the attacker, leaks memory or runs code in the context of the current user. No public exploit code has been identified at time of analysis.