Out-of-bounds write in Siemens Solid Edge SE2024
Priority LOW 33CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 12), Solid Edge SE2025 (All versions < V225.0 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer while parsing X_T data or a specially crafted file in X_T format. This could allow an attacker to execute code in the context of the current process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed Solid Edge SE2024 (Siemens): V224.0 Update 12Solid Edge SE2025 (Siemens): V225.0 Update 3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Solid Edge SE2024 | before V224.0 Update 12 | V224.0 Update 12 | Patch available | CNA |
| Siemens | Solid Edge SE2025 | before V225.0 Update 3 | V225.0 Update 3 | Patch available | CNA |
- Solid Edge SE2024 VendorSiemens Affected before V224.0 Update 12 Fixed in V224.0 Update 12 Patch available CNA
- Solid Edge SE2025 VendorSiemens Affected before V225.0 Update 3 Fixed in V225.0 Update 3 Patch available CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* | 36.1 to before 36.1.225; 37.0 to before 37.0.173 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:-:*:*:*:*:*:* | 224.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0001:*:*:*:*:*:* | 224.0 update_0001 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_00010:*:*:*:*:*:* | 224.0 update_00010 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_00011:*:*:*:*:*:* | 224.0 update_00011 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0002:*:*:*:*:*:* | 224.0 update_0002 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0003:*:*:*:*:*:* | 224.0 update_0003 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0004:*:*:*:*:*:* | 224.0 update_0004 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0005:*:*:*:*:*:* | 224.0 update_0005 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* Versions 36.1 to before 36.1.225; 37.0 to before 37.0.173 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:-:*:*:*:*:*:* Versions 224.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0001:*:*:*:*:*:* Versions 224.0 update_0001 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_00010:*:*:*:*:*:* Versions 224.0 update_00010 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_00011:*:*:*:*:*:* Versions 224.0 update_00011 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0002:*:*:*:*:*:* Versions 224.0 update_0002 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0003:*:*:*:*:*:* Versions 224.0 update_0003 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0004:*:*:*:*:*:* Versions 224.0 update_0004 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0005:*:*:*:*:*:* Versions 224.0 update_0005 Vulnerable ·Siemens
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0006:*:*:*:*:*:* | 224.0 update_0006 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0007:*:*:*:*:*:* | 224.0 update_0007 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0008:*:*:*:*:*:* | 224.0 update_0008 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0009:*:*:*:*:*:* | 224.0 update_0009 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:-:*:*:*:*:*:* | 225.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0001:*:*:*:*:*:* | 225.0 update_0001 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0002:*:*:*:*:*:* | 225.0 update_0002 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0003:*:*:*:*:*:* | 225.0 update_0003 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0006:*:*:*:*:*:* Versions 224.0 update_0006 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0007:*:*:*:*:*:* Versions 224.0 update_0007 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0008:*:*:*:*:*:* Versions 224.0 update_0008 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2024:224.0:update_0009:*:*:*:*:*:* Versions 224.0 update_0009 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:-:*:*:*:*:*:* Versions 225.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0001:*:*:*:*:*:* Versions 225.0 update_0001 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0002:*:*:*:*:*:* Versions 225.0 update_0002 Vulnerable ·Siemens
- cpe:2.3:a:siemens:solid_edge_se2025:225.0:update_0003:*:*:*:*:*:* Versions 225.0 update_0003 Vulnerable ·Siemens
Remediation
- Fix · CNA Solid Edge SE2024 (Siemens) Fixed in V224.0 Update 12
- Fix · CNA Solid Edge SE2025 (Siemens) Fixed in V225.0 Update 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-54091
- 2026-10-03 Alias added: GHSA-h9pg-36c2-7xw9
References
More Siemens Parasolid vulnerabilities
- TI-2022-22893 Out-of-bounds read in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
- TI-2022-22891 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
- TI-2024-21079 Out-of-bounds write in Siemens Parasolid V35.1 CVSS 3.1HIGH 7.8
- TI-2023-24404 Stack-based buffer overflow in Siemens Parasolid V35.0 CVSS 3.1HIGH 7.8
- TI-2023-21659 Out-of-bounds write in Siemens Parasolid V34.1 CVSS 3.1HIGH 7.8
- TI-2022-22892 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
Sources
- CVE-2024-54091 · CVE Program
- CVE-2024-54091 · NVD
- FIRST EPSS
- GHSA-h9pg-36c2-7xw9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences