Out-of-bounds read in Siemens Solid Edge
Priority LOW 36CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed Solid Edge (Siemens): V224.0 Update 4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Solid Edge | before V224.0 Update 4 | V224.0 Update 4 | Patch available | CNA |
- Solid Edge VendorSiemens Affected before V224.0 Update 4 Fixed in V224.0 Update 4 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:solid_edge_se2024:*:*:*:*:*:*:*:* | before 224.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:-:*:*:*:*:*:* | 224.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0001:*:*:*:*:*:* | 224.0 update_0001 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0002:*:*:*:*:*:* | 224.0 update_0002 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0003:*:*:*:*:*:* | 224.0 update_0003 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:solid_edge_se2024:*:*:*:*:*:*:*:* Versions before 224.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:-:*:*:*:*:*:* Versions 224.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0001:*:*:*:*:*:* Versions 224.0 update_0001 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0002:*:*:*:*:*:* Versions 224.0 update_0002 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0003:*:*:*:*:*:* Versions 224.0 update_0003 Vulnerable ·Siemens
Remediation
- Fix · CNA Solid Edge (Siemens) Fixed in V224.0 Update 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34772
- 2026-10-03 Alias added: GHSA-6w44-6jp6-9hq9
References
More Siemens Solid Edge Se2024 vulnerabilities
- TI-2024-23063 Stack-based buffer overflow in Siemens Solid Edge CVSS 3.1HIGH 7.8
- TI-2024-23061 Heap-based buffer overflow in Siemens Solid Edge CVSS 3.1HIGH 7.8
- TI-2024-22086 Out-of-bounds read in Siemens Solid Edge CVSS 3.1HIGH 7.8
- TI-2024-22085 Out-of-bounds read in Siemens Solid Edge CVSS 3.1HIGH 7.8
- TI-2024-22084 Out-of-bounds read in Siemens Solid Edge CVSS 3.1HIGH 7.8
- TI-2024-22083 Out-of-bounds read in Siemens Solid Edge CVSS 3.1HIGH 7.8
Sources
- CVE-2024-34772 · CVE Program
- CVE-2024-34772 · NVD
- FIRST EPSS
- GHSA-6w44-6jp6-9hq9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences