Simcenter Femap CVE-2025-40829

Exploitation requires a user of Simcenter Femap (any version below V2512) to open an attacker-supplied, specially crafted SLDPRT (SolidWorks part) file; the uninitialized-memory flaw is triggered during parsing of that file. Limiting factors: the attack vector is local (AV:L) with required user interaction (UI:P), so the attacker must socially engineer the victim into opening the file - there is no remote, unauthenticated, or network-triggered path; high attack complexity (AC:H) reflects that reliably weaponizing an uninitialized-memory condition into code execution is non-trivial. No special Femap configuration is needed - the vulnerable SLDPRT parsing is in the default product.

This is a client-side file-parsing memory-safety flaw (CWE-908, use of uninitialized resource) in Siemens Simcenter Femap, rated CVSS 4.0 base 7.3. The vendor vector (AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) tells a consistent story: exploitation is local and requires the victim to open a malicious SLDPRT file (UI:P), is non-trivial to execute reliably (AC:H, expected for an uninitialized-memory primitive), and if it works yields full confidentiality/integrity/availability impact to the current process. All exploitation signals point to LOW real-world urgency: EPSS is 0.20% (9th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified. The finding originates from Trend Micro's Zero Day Initiative (ZDI-CAN-27146) and was coordinated through Siemens ProductCERT, which indicates responsible disclosure rather than observed in-the-wild abuse. One labeling tension to verify: the input Tag says 'Information Disclosure,' but the description and CWE-908 describe uninitialized-memory use leading to arbitrary code execution - treat the primary impact as code execution, not mere info disclosure. Net: a legitimately high-impact bug but a low-likelihood, user-interaction-gated, local-vector issue - prioritize via normal patch cycles, not emergency response, for engineering teams that run Femap.

An attacker crafts a malicious SLDPRT (SolidWorks part) file and delivers it to an engineer via email, a shared project repository, or a supplier file exchange. When the victim opens the file in a vulnerable Simcenter Femap build (< V2512), the parser consumes uninitialized memory, giving the attacker a path to execute code in the context of the Femap process on the engineering workstation. No public proof-of-concept was identified at time of analysis; the issue was found through Trend Micro ZDI and coordinated disclosure.