CVE-2023-49122: High Heap Overflow in Siemens Solid Edge PAR Files

CVE-2023-49122 is a high severity (CVSS 7.8) heap-based buffer overflow in Siemens Solid Edge SE2023, triggered when the application parses a crafted PAR file. A user must open the file. Siemens fixed it in V223.0 Update 10, so update and avoid opening PAR files from unknown sources.

What's affected

• Siemens Solid Edge SE2023, all versions below V223.0 Update 10, per Siemens advisory SSA-589891, published 9 January 2024.
• Fix: update to V223.0 Update 10 or later. Siemens says the update fixes multiple vulnerabilities triggered when the application reads PAR files.
• Siemens states that a malicious file could lead to a crash and potentially to arbitrary code execution on the host.
• This is one of eleven CVEs in the same advisory that share the affected versions and fix: CVE-2023-49121, CVE-2023-49123, CVE-2023-49124, CVE-2023-49126, CVE-2023-49127, CVE-2023-49128, CVE-2023-49129, CVE-2023-49130, CVE-2023-49131, CVE-2023-49132.
• Siemens' own vector adds temporal metrics to the base vector, but the base score of 7.8 matches the NVD record, so there is no severity conflict.
• Severity: the record gives CVSS 7.8, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.

The CVSS 3.1 vector in the record is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Read plainly, it describes an attack with local access, with low attack complexity, requiring no privileges and a user action such as opening a file or clicking a link. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.

How to check if you're exposed

Solid Edge is desktop software, so check it the way you check other engineering applications. Find the installed version and update level on each workstation, through the application's about information or your software inventory tool, and compare it with V223.0 Update 10.

Then find who handles PAR files. PAR files are Solid Edge part documents, and they often arrive from suppliers, customers and downloaded model libraries. List the teams that open files from outside your company, and the shared folders where such files land.

If you cannot read update levels centrally, ask engineers to report them, and keep the answers in a single list.

What to do now

1. Update every Solid Edge SE2023 installation to V223.0 Update 10 or later, using the vendor's download and update process.
2. Until you have updated, avoid opening PAR files from untrusted or unknown sources, which is the workaround Siemens gives.
3. Tell engineers to treat files from external parties like attachments from unknown senders.
4. Run Solid Edge under a standard user account, not an administrator account, so code running in the process has fewer rights.
5. Add the engineering workstations to your patch inventory so CAD updates are tracked like any other software.

Why it matters

This CVE is classed as CWE-122 (Heap-based Buffer Overflow). A heap-based buffer overflow means the program writes more data into a block of dynamically allocated memory than the block can hold, damaging neighbouring data. In a file parser, the file itself decides how much data arrives, so a crafted file can push past the intended limit.

The record's vector needs local access and a user action, which fits a file based attack: someone has to open the file. That lowers the chance of mass exploitation compared with a network service, but CAD files are exchanged routinely. A supplier's account, a shared drive or an email attachment can all deliver one. Parsers for complex binary formats are a steady source of memory safety bugs, which is why Siemens published eleven related fixes in one update.

Quick check

Sources

• Siemens advisory SSA-589891
• CWE-122 in the Gold directory

Last reviewed: 19 October 2026.