What is the CVSS score of CVE-2026-23720?

CVE-2026-23720 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Simcenter Femap are affected by CVE-2026-23720?

Simcenter Femap and Nastran users face a high-severity vulnerability (CVSS 7.8) that could allow attackers to crash applications or potentially execute code by submitting malicious NDB files.

How to fix or mitigate CVE-2026-23720?

Within 24 hours: Identify all systems running Simcenter Femap or Nastran versions prior to V2512 and restrict file import capabilities where possible. Within 7 days: Implement network controls to limit NDB file processing to trusted sources only and disable automatic file opening features. Within 30 days: Plan immediate upgrade to V2512 or later once patch becomes available, and establish file validation procedures before processing any NDB files.

Simcenter Femap CVE-2026-23720

HIGH

Out-of-bounds Read (CWE-125)

2026-02-10 productcert@siemens.com

Buffer Overflow Information Disclosure Siemens Simcenter Femap Simcenter Nastran

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 10:15 nvd

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered when parsing malicious NDB files. A local attacker with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). Affects Simcenter Femap. A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.