CVE-2025-40796 is an out-of-bounds read vulnerability (CWE-125) in Siemens SIMATIC PCS neo's integrated User Management Component (UMC). It affects all versions of SIMATIC PCS neo 4.1 and 5.0, and versions of 6.0 prior to SP1 Update 1, as well as UMC versions prior to 2.15.1.3. The vulnerability allows an unauthenticated remote attacker to cause a denial of service condition by triggering the out-of-bounds read. The CVSS 3.1 score of 7.5 reflects a high severity with network attack vector, no privileges or user interaction required, and impact limited to availability. No known exploits are reported in the wild. Patch or remediation details are not provided in the available data.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service condition, impacting the availability of the affected Siemens SIMATIC PCS neo systems. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, consider restricting network access to the affected components to trusted users only and monitor for unusual service disruptions related to the User Management Component.