Solid Edge CVE-2025-40812

Exploitation requires a user to open an attacker-supplied, specially crafted PRT (Solid Edge part) file in a vulnerable Solid Edge SE2024 (< V224.0 Update 14) or SE2025 (< V225.0 Update 6) installation - this is the exact trigger. Limiting factors are significant: the vector is local (AV:L, no network/remote reach), it demands passive user interaction (UI:P - the victim must be induced to open the file), and attack complexity is high (AC:H), reflecting that the out-of-bounds read does not deterministically yield code execution. There is no default-configuration remote exposure; risk is confined to environments where engineers open untrusted or externally sourced CAD files.

This is a genuinely moderate-priority issue that should not be over-escalated despite a potential code-execution outcome. Every signal points toward low real-world urgency: the CVSS 4.0 vector is AV:L (local) with AC:H (high complexity) and UI:P (passive user interaction), meaning an attacker cannot reach the flaw over the network and must get an engineer to open a malicious PRT file, and even then exploitation is unreliable. EPSS is 0.14% (3rd percentile), it is NOT on the CISA KEV list, and no public exploit code is identified - all three exploitation signals agree with the CVSS profile, so there is no conflict here. The 7.3 (HIGH) base score is driven almost entirely by the VC:H/VI:H/VA:H impact triad (potential code execution in the current user's process), not by ease of attack. In short: high theoretical impact, low practical likelihood. One nuance worth noting is that an out-of-bounds READ (CWE-125) typically yields a crash or information disclosure far more readily than reliable arbitrary code execution; the 'execute code' claim is the vendor's worst-case assessment and the AC:H rating reflects that RCE is not straightforward. Treat this as a patch-in-normal-cycle item, prioritized for workstations that routinely open untrusted CAD files.

An attacker emails or shares a specially crafted Solid Edge PRT part file to a mechanical engineer, perhaps disguised as a supplier component or project drawing. When the victim opens the file in a vulnerable Solid Edge SE2024/SE2025 installation, the malformed data triggers an out-of-bounds read while parsing, crashing the application or, in the worst case, executing code in the context of the logged-in user. No public proof-of-concept exploit has been identified at time of analysis.