What is the CVSS score of CVE-2026-23719?

CVE-2026-23719 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Simcenter Femap are affected by CVE-2026-23719?

Simcenter Femap and Nastran users face a HIGH severity vulnerability (CVE-2026-23719) that could allow attackers to execute arbitrary code by sending malicious NDB files.

How to fix or mitigate CVE-2026-23719?

Within 24 hours: Inventory all systems running Simcenter Femap and Nastran versions below V2512 and restrict file-handling permissions. Within 7 days: Implement network controls to block untrusted NDB file sources and disable NDB file processing where operationally feasible; notify users not to open NDB files from external sources. Within 30 days: Monitor vendor communications for patch availability and prepare deployment procedures; conduct file integrity monitoring on engineering workstations.

Simcenter Femap CVE-2026-23719

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-10 productcert@siemens.com

Buffer Overflow Heap Overflow Simcenter Femap Simcenter Nastran

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 10:15 nvd

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Heap-based buffer overflow in Simcenter Femap and Nastran versions prior to V2512 allows local attackers to achieve arbitrary code execution by crafting malicious NDB files. The vulnerability requires user interaction to trigger and affects all current versions of both products. No patch is currently available, leaving affected systems at risk of privilege escalation and system compromise.

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Affects Simcenter Femap. A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.