What is the CVSS score of CVE-2026-23720?

CVE-2026-23720 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Simcenter Femap are affected by CVE-2026-23720?

Simcenter Femap and Nastran users face a high-severity vulnerability (CVSS 7.8) that could allow attackers to crash applications or potentially execute code by submitting malicious NDB files.

How to fix or mitigate CVE-2026-23720?

Within 24 hours: Identify all systems running Simcenter Femap or Nastran versions prior to V2512 and restrict file import capabilities where possible. Within 7 days: Implement network controls to limit NDB file processing to trusted sources only and disable automatic file opening features. Within 30 days: Plan immediate upgrade to V2512 or later once patch becomes available, and establish file validation procedures before processing any NDB files.

Simcenter Femap CVE-2026-23720

HIGH

Out-of-bounds Read (CWE-125)

2026-02-10 productcert@siemens.com

Buffer Overflow Information Disclosure Simcenter Femap Simcenter Nastran

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 10:15 nvd

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered when parsing malicious NDB files. A local attacker with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious NDB file

Delivery

Distribute via email or file sharing

Exploit

User opens file in Femap/Nastran

Execution

Out-of-bounds read in parser

Impact

Execute arbitrary code

Access

Craft malicious NDB file

Delivery

Distribute via email or file sharing

Exploit

User opens file in Femap/Nastran

Execution

Out-of-bounds read in parser

Impact

Execute arbitrary code

Vulnerability AssessmentAI

Exploitation	User interaction required: victim must open a specially crafted NDB (Nastran Database) file in Simcenter Femap or Simcenter Nastran versions earlier than V2512. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.8 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to execute code in the context of the current process.
Remediation	Monitor vendor advisories for a patch. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running Simcenter Femap or Nastran versions prior to V2512 and restrict file import capabilities where possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.