CVE-2023-49125

Vulnerability

The vulnerability is an out-of-bounds read past the end of an allocated structure that occurs when parsing specially crafted XT format files in Parasolid and Solid Edge. Affected versions include Parasolid V35.0 (all versions < V35.0.263), V35.1 (all versions < V35.1.252), V36.0 (all versions < V36.0.198), Solid Edge SE2023 (all versions < V223.0 Update 11), and Solid Edge SE2024 (all versions < V224.0 Update 3) [1].

Exploitation

An attacker must trick a user into opening a malicious XT file with an affected application. No authentication is required, but user interaction is necessary. The crafted file triggers the out-of-bounds read, which can be leveraged to execute arbitrary code [1].

Impact

Successful exploitation allows an attacker to execute code in the context of the current process, potentially leading to full compromise of the affected system, including disclosure of sensitive information, modification of data, and denial of service [1].

Mitigation

Siemens has released fixed versions: Parasolid V35.0.263, V35.1.252, V36.0.198; Solid Edge SE2023 Update 11, and Solid Edge SE2024 Update 3. Users should update to the latest versions. As a workaround, do not open untrusted XT files [1][2].