The vulnerability is an out‑of‑bounds read that occurs when the application parses specially crafted NDB files. Because the read can be abused to execute code in the context of the running process, an attacker that supplies a malicious NDB file could gain arbitrary code execution privilege on the affected system.

Siemens Simcenter Femap (all versions prior to V2512) and Siemens Simcenter Nastran (all versions prior to V2512) are affected. The same vulnerability applies to every version below V2512 in both products.

The CVSS score of 7.3 indicates a high severity, but the EPSS score is listed as less than 1%, implying that the likelihood of a widespread exploit is low at present. The vulnerability is not in the CISA KEV catalog. The attack path requires delivery of a crafted NDB file, which then triggers the vulnerable parsing routine. The required conditions do not demand elevated privileges, so a local user who runs the application could be exploited, and if the application processes files from a network share, a remote attacker could deliver the file indirectly. Because the flaw can lead to code execution, the impact is severe, yet the current exploitation probability appears to be low.