Description
A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.
Published: 2026-02-10
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a heap-based buffer overflow that occurs while the application parses specially crafted NDB files. The flaw can allow an attacker to execute arbitrary code in the context of the running process. It is identified as a CWE‑122 weakness.

Affected Systems

The affected software is Siemens Simcenter Femap and Simcenter Nastran, all releases prior to version V2512.

Risk and Exploitability

The CVSS score is 7.3, indicating a high severity. However, the EPSS score is below 1%, suggesting that the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is file-based: an attacker supplies a malicious NDB file that the victim opens, giving the attacker remote code execution capabilities within the victim’s process.

Generated by OpenCVE AI on April 17, 2026 at 20:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Simcenter Femap and Simcenter Nastran version V2512 or later.
  • Restrict the source of NDB files by ensuring only trusted users or processes can create or place them in directories accessed by the application.
  • When upgrades are not immediately possible, validate or quarantine NDB files before opening them to prevent malicious input.
  • Implement monitoring of application activity and anomalous behavior that could indicate exploitation attempts.

Generated by OpenCVE AI on April 17, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Title Heap Buffer Overflow in Siemens Simcenter Femap and Nastran via NDB File Parsing

Wed, 11 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simcenter_nastran:*:*:*:*:*:*:*:*

Tue, 10 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Siemens
Siemens simcenter Femap
Siemens simcenter Nastran
Vendors & Products Siemens
Siemens simcenter Femap
Siemens simcenter Nastran

Tue, 10 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Siemens Simcenter Femap Simcenter Nastran
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2026-02-10T15:07:14.343Z

Reserved: 2026-01-15T14:48:10.775Z

Link: CVE-2026-23719

cve-icon Vulnrichment

Updated: 2026-02-10T15:07:08.599Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-10T10:15:58.910

Modified: 2026-02-11T18:23:23.400

Link: CVE-2026-23719

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T21:00:12Z

Weaknesses