Siemens Solid Edge / PS/IGES Parasolid Translator out-of-bounds read via crafted IGS files

I could not find an authoritative record for CVE-2026-40936. All authoritative hits converge on CVE-2025-40936, a Siemens out-of-bounds read in the PS/IGES Parasolid Translator Component that is also called out in Solid Edge advisories. Siemens says the affected ranges are PS/IGES Parasolid Translator Component < V29.0.258 and Solid Edge < V226.00 Update 03; the bug is triggered when a user opens a specially crafted IGS file, causing a crash or possible code execution in the current process.

If this is the issue your tooling meant, the raw vendor impact is high, but the *operational* risk is lower than that label suggests. This is not unauthenticated network reachability; it is a local file-parsing bug with required user interaction, on a specialized engineering desktop population, with no KEV listing, no public PoC located, and very low EPSS. For a patch team managing thousands of endpoints, that makes this a MEDIUM patching problem unless you have a large Siemens CAD estate that routinely ingests external design files.

Why this verdict

• Identifier mismatch matters: there is no authoritative record for CVE-2026-40936; this is an initial assessment of the likely intended Siemens issue, not a comparison against a baseline.
• User-opened file requirement cuts severity: the attacker needs delivery plus a human open action, which modern email security, web filtering, and user behavior often interrupt before exploit code ever runs.
• Population and blast radius are narrow: affected software lives on engineering workstations, not on internet-facing servers, and compromise typically lands in the current user context rather than domain-wide by default.

Why not higher?

I did not find KEV status, exploitation evidence, or a public PoC. More importantly, the chain is not unauthenticated remote exploitation; it depends on a malicious file reaching a user who actually handles IGS content and then being opened in a vulnerable app.

Why not lower?

This still carries plausible code execution impact on high-value engineering endpoints that often store sensitive design IP and connect to shared repositories. Supplier and partner file exchange is a realistic delivery channel, so this is not just theoretical crash-only noise.

1. Gate external IGS files — Route externally sourced IGS attachments and downloads for detonation or manual approval before they reach engineering users. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control is worth deploying now if your CAD teams regularly exchange files with suppliers.
2. Isolate engineering workstations — Keep Solid Edge and related CAD endpoints in a tighter policy zone with stronger EDR, reduced local admin, and limited access to sensitive file shares. There is no mitigation SLA here, so apply this selectively where the business actually processes third-party design files while you work the remediation window.
3. Hunt for risky file-open patterns — Alert on IGS files opened directly from email temp paths, browser download folders, Teams/SharePoint sync folders, or untrusted SMB locations. This is a high-signal compensating control for engineering populations because it focuses on the actual exploitation path instead of generic CVE noise.
4. Restrict untrusted child-process behavior — Use EDR exploit prevention, ASR-style rules, or application control to suppress suspicious child processes and post-exploitation behavior from CAD applications. That will not fix the parser, but it can reduce the chance that a file-open becomes durable user-context compromise during the remediation window.

Run this on the target Windows endpoint that may have Siemens Solid Edge installed, or push it remotely with your endpoint tooling. Invoke it as powershell -ExecutionPolicy Bypass -File .\check-solidedge-cve-2025-40936.ps1; standard user rights are usually enough for a local check, though remote collection may require admin depending on your tooling.

# check-solidedge-cve-2025-40936.ps1

# Detects likely exposure to the Siemens Solid Edge issue commonly published as CVE-2025-40936.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-UninstallEntries {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $items = @()
    foreach ($p in $paths) {
        try {
            $items += Get-ItemProperty -Path $p -ErrorAction SilentlyContinue | Where-Object {
                $_.DisplayName -match 'Solid Edge'
            }
        } catch {}
    }
    return $items
}

function Parse-SolidEdgeVersion {
    param([string]$VersionString)

    if ([string]::IsNullOrWhiteSpace($VersionString)) { return $null }

    $major = $null
    $minor = 0
    $update = 0

    if ($VersionString -match '(?i)V?(\d+)(?:\.(\d+))?') {
        $major = [int]$matches[1]
        if ($matches[2]) { $minor = [int]$matches[2] }
    }

    if ($VersionString -match '(?i)Update\s*(\d+)') {
        $update = [int]$matches[1]
    } elseif ($VersionString -match '^(\d+)\.(\d+)\.(\d+)$') {
        $major = [int]$matches[1]
        $minor = [int]$matches[2]
        $update = [int]$matches[3]
    }

    if ($null -eq $major) { return $null }

    [PSCustomObject]@{
        Raw    = $VersionString
        Major  = $major
        Minor  = $minor
        Update = $update
    }
}

function Compare-ToFixedVersion {
    param($Parsed)

    # Fixed vendor version: V226.00 Update 03

    if ($Parsed.Major -lt 226) { return 'VULNERABLE' }
    if ($Parsed.Major -gt 226) { return 'PATCHED' }

    # Major == 226

    if ($Parsed.Minor -lt 0) { return 'VULNERABLE' }
    if ($Parsed.Minor -gt 0) { return 'PATCHED' }

    if ($Parsed.Update -lt 3) { return 'VULNERABLE' }
    return 'PATCHED'
}

try {
    $entries = Get-UninstallEntries

    if (-not $entries -or $entries.Count -eq 0) {
        Write-Output 'UNKNOWN - Solid Edge not found in uninstall registry paths'
        exit 2
    }

    $best = $entries | Sort-Object -Property DisplayVersion -Descending | Select-Object -First 1
    $parsed = Parse-SolidEdgeVersion -VersionString $best.DisplayVersion

    if ($null -eq $parsed) {
        Write-Output ('UNKNOWN - Found Solid Edge but could not parse version string: ' + $best.DisplayVersion)
        exit 2
    }

    $result = Compare-ToFixedVersion -Parsed $parsed

    if ($result -eq 'VULNERABLE') {
        Write-Output ('VULNERABLE - Solid Edge version appears below V226.00 Update 03 (' + $parsed.Raw + ')')
        exit 1
    }

    Write-Output ('PATCHED - Solid Edge version appears at or above V226.00 Update 03 (' + $parsed.Raw + ')')
    exit 0
}
catch {
    Write-Output ('UNKNOWN - Error during check: ' + $_.Exception.Message)
    exit 2
}

Sources

1. Siemens ProductCERT SSA-241605
2. Siemens ProductCERT SSA-445819
3. NVD CVE-2025-40936
4. GitHub Advisory GHSA-295f-pwgh-q72q
5. OpenCVE CVE-2025-40936
6. Zero Day Initiative ZDI-25-1042
7. CISA Known Exploited Vulnerabilities Catalog