Which versions of Simcenter Femap are affected by CVE-2025-12659?

Siemens Simcenter Femap versions prior to V2512.0003 contain a heap-based memory corruption vulnerability (CVE-2025-12659, CVSS 7.3) enabling arbitrary code execution when users open malicious…

How to fix or mitigate CVE-2025-12659?

Within 24 hours: identify all Femap installations via asset management tools and notify engineering teams of the file-based attack vector; document current version inventory. Within 7 days: implement file-extension blocking (IPT format) at email gateways and endpoint detection rules, disable auto-preview of design files in Windows/macOS file managers, and conduct targeted security awareness training for CAD users on social-engineering risks. Within 30 days: monitor Siemens ProductCERT and CISA advisories for V2512.0003 patch availability and deploy immediately upon release; if unavailable within this window, escalate for risk-acceptance approval and transition critical design workflows to network-isolated systems or alternative CAD software pending remediation.

Simcenter Femap CVE-2025-12659

Q: What is the CVSS score of CVE-2025-12659?

CVE-2025-12659 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209785 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-12 icscert

GHSA-8qfq-8cwv-5jpc

Buffer Overflow Heap Overflow Siemens Simcenter Femap

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Exploitation needs a local crafted file opened by the user (AV:L, UI:R) and a carefully built file (AC:H); no privileges required (PR:N), with full code-execution impact on the user's process.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:29 vuln.today

CVE Published

May 12, 2026 - 12:30 cve.org

HIGH 7.3

CVE Published

May 12, 2026 - 12:30 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The affected applications contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27349, ZDI-CAN-27389)

AnalysisAI

Arbitrary code execution in Siemens Simcenter Femap (all versions before V2512.0003) arises from a heap-based memory corruption bug triggered when the application parses a specially crafted IPT (Inventor part) file, letting an attacker run code in the context of the current user process. Discovered through ZDI (ZDI-CAN-27349, ZDI-CAN-27389) and published via a Siemens ProductCERT advisory and CISA ICS advisory, the flaw requires the victim to open a malicious file, so it is a local, user-interaction-dependent issue rather than a remotely reachable one. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA's SSVC marks exploitation as none.

Technical ContextAI

Simcenter Femap is a Siemens finite-element modeling and post-processing engineering (CAE) application used to build and analyze simulation models. The vulnerability is a CWE-122 heap-based buffer overflow in the routine that imports/parses IPT files (Autodesk Inventor part geometry). The affected CPE is cpe:2.3:a:siemens:simcenter_femap, confirming a single application product rather than a library or service. Heap corruption of this type typically stems from insufficient bounds validation of length or offset values read from the untrusted file, allowing an out-of-bounds write into heap-allocated structures that can be groomed to hijack control flow and achieve code execution.

RemediationAI

Vendor-released patch: upgrade Simcenter Femap to V2512.0003 or later, per Siemens advisory SSA-870926 (https://cert-portal.siemens.com/productcert/html/ssa-870926.html) and CISA ICSA-26-134-05 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05). Until the update is deployed, because exploitation depends on opening a malicious file, only open IPT files received from trusted sources and avoid importing files of unknown or untrusted origin - the trade-off is reduced convenience in multi-party engineering workflows. Restrict Femap use to protected, network-segmented engineering workstations and apply least-privilege so that code execution occurs in a low-privileged user context, limiting downstream impact.