CVE-2025-40797 is an out-of-bounds read vulnerability (CWE-125) in the integrated User Management Component of Siemens SIMATIC PCS neo software. Affected versions include all versions of SIMATIC PCS neo 4.1 and 5.0, and versions of 6.0 before SP1 Update 1, as well as UMC versions prior to 2.15.1.3. The vulnerability allows an unauthenticated remote attacker to cause a denial of service condition by exploiting the out-of-bounds read flaw. The CVSS 3.1 score of 7.5 reflects a high severity impact focused on availability. There is no indication of confidentiality or integrity impact. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability enables an unauthenticated remote attacker to cause a denial of service (DoS) condition, impacting the availability of affected Siemens SIMATIC PCS neo systems. There is no evidence of confidentiality or integrity compromise. The high CVSS score (7.5) reflects the significant availability impact.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected components to trusted users only to reduce exposure. Monitor Siemens communications for updates on patches or mitigations.