CVE-2025-40936

HighCVSS 7.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Simcenter Femap (All versions < V2512.0003), Solid Edge (All versions < V226.00 Update 03). The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
SiemensPS/IGES Parasolid Translator Component< V29.0.258
SiemensSimcenter Femap< V2512.0003
SiemensSolid Edge< V226.00 Update 03

References

Timeline

Published
Nov 17, 2025
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-409378.8A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input paraCVE-2025-409389.8A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmCVE-2025-409394.6A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port which allows unautheCVE-2025-40949.8The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it CVE-2025-409404.9A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behaviorCVE-2025-409414.3A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its respoCVE-2025-409427.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege eCVE-2025-409439.6Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineeringCVE-2025-409447.5A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ECVE-2025-409456.7A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (AlCVE-2025-409468.3A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 1CVE-2025-409477.5A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGE
CVE-2025-40936: High severity, CVSS 7.8 | Vulnix