Siemens Solid Edge
Plan Patch7.8ICS-CERT ICSA-25-289-05Oct 14, 2025
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Solid Edge SE2024 and SE2025 contain multiple file parsing vulnerabilities (buffer overflow and out-of-bounds read) in the PRT file format handler. When an application reads a specially crafted PRT file, these flaws can cause the application to crash or allow arbitrary code execution. Siemens has released patched versions: SE2024 224.0 Update 14 and SE2025 225.0 Update 6. No public exploitation has been reported. These vulnerabilities are not remotely exploitable and require user interaction to open a malicious file.
What this means
What could happen
An attacker with access to a user's workstation could crash Solid Edge or execute arbitrary code by distributing a malicious PRT file, potentially allowing them to compromise the design workstation and access sensitive manufacturing data or CAD models.
Who's at risk
Design engineers and CAD operators at manufacturing companies, engineering firms, and utilities that use Siemens Solid Edge SE2024 or SE2025 for equipment design and planning. This affects any organization that handles PRT files in their design workflow, especially those receiving designs from external partners or suppliers.
How it could be exploited
An attacker crafts a malicious PRT (Siemens Solid Edge part) file and sends it to an engineer or designer, either as an email attachment or via a file share. When the user opens the file in Solid Edge, the application parses the crafted data, triggering a buffer overflow or out-of-bounds memory read that either crashes the application or allows code execution.
Prerequisites
- User must open or import a malicious PRT file in Solid Edge
- Local access to the design workstation running affected Solid Edge version
- User interaction required (opening a file)
User interaction required (file opening)Local access only—not remotely exploitableLow attack complexityDesign/engineering workstations may contain sensitive intellectual property and process documentation
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Solid Edge SE2024<V224.0 Update 14224.0 Update 14
Solid Edge SE2025<V225.0 Update 6225.0 Update 6
Remediation & Mitigation
0/5
Do now
0/2WORKAROUNDDo not open PRT files from untrusted sources until patched
HARDENINGImplement email content filtering to block or quarantine PRT file attachments from external senders
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Solid Edge SE2024
HOTFIXUpdate Solid Edge SE2024 to version 224.0 Update 14 or later
Solid Edge SE2025
HOTFIXUpdate Solid Edge SE2025 to version 225.0 Update 6 or later
Long-term hardening
0/1HARDENINGRestrict network access to design workstations and isolate them from internet-facing networks
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/25fb3808-146f-4ab6-a8b4-34caadcc5cb4