Simcenter Femap CVE-2025-12659

Exploitation requires the victim to open or import a specially crafted IPT file into Simcenter Femap on a vulnerable version (before V2512.0003); the attacker cannot trigger it remotely without this interaction. Limiting factors: local vector (AV:L), required passive user interaction (UI:P - the user must open the malicious file), and high attack complexity (AC:H), meaning a reliably weaponized IPT file is non-trivial to build. No authentication or elevated privileges are needed on the attacker's side (PR:N), but the impact is confined to the privileges of the user running Femap.

The signals consistently point to a real but not urgent issue. The Siemens CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, base 7.3) shows total technical impact but requires local access, high attack complexity, and victim interaction - you must convince an engineer to open a crafted IPT file. EPSS is 0.02% (4th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total, which aligns: high consequence if triggered, but no evidence of active or scalable exploitation. This is not KEV-listed and no POC is identified, so it should be patched on a normal maintenance cadence rather than emergency-treated. No major conflicts in the data; the main caveat is that the AC:H/automatable:no rating means practical exploitation likely needs a tailored file and social engineering.

An attacker emails or shares a booby-trapped IPT part file to an engineer and relies on them importing it into Simcenter Femap. When Femap parses the file, the heap overflow corrupts memory and executes attacker-supplied code in the context of the current user, giving the attacker a foothold on the engineering workstation. No public POC is identified, and the high attack complexity means the crafted file must be carefully constructed.