Description
A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.
Published: 2026-02-10
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read when parsing specially crafted XDB files. This defect allows an attacker to govern arbitrary code execution inside the context of the application process, thereby enabling compromise of the system.

Affected Systems

Siemens Simcenter Femap and Simcenter Nastran are affected. All releases prior to version V2512 contain the flaw.

Risk and Exploitability

The CVSS score of 7.3 marks this issue as high severity. The EPSS score under 1 percent indicates a low exploitation probability at this time. It is not listed in CISA’s KEV catalog. The most likely attack vector is via a malicious XDB file supplied to the vulnerable application, resulting in code execution constrained to the privileges under which the application runs.

Generated by OpenCVE AI on April 17, 2026 at 20:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Simcenter Femap or Nastran to version V2512 or later.
  • Restrict import or processing of XDB files to trusted users or scripts.
  • If an upgrade is not immediately feasible, disable or remove the affected application from the environment.

Generated by OpenCVE AI on April 17, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read in Siemens Simcenter Femap and Nastran Allowing Remote Code Execution

Wed, 11 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simcenter_nastran:*:*:*:*:*:*:*:*

Tue, 10 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Siemens
Siemens simcenter Femap
Siemens simcenter Nastran
Vendors & Products Siemens
Siemens simcenter Femap
Siemens simcenter Nastran

Tue, 10 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Siemens Simcenter Femap Simcenter Nastran
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2026-02-10T15:26:34.955Z

Reserved: 2026-01-15T14:48:10.775Z

Link: CVE-2026-23716

cve-icon Vulnrichment

Updated: 2026-02-10T15:26:31.725Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-10T10:15:58.393

Modified: 2026-02-11T18:24:30.713

Link: CVE-2026-23716

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T21:00:12Z

Weaknesses