CVE-2025-40829
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected application contains an uninitialized memory vulnerability while parsing specially crafted SLDPRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27146)
Risk Assessment
Code execution in the context of the current process could allow an attacker to take control of the application, potentially leading to data theft or further system compromise.
Recommendation
It is recommended to update Simcenter Femap to version V2512 or later, which includes the fix.
Other vulnerabilities in Simcenter Femap
See all- CVE-2026-59701High
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2026-59700High
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2026-59086High
Simcenter Femap and Simcenter Nastran (versions before V2606) contain a stack overflow vulnerability while parsing specially crafted strings as arguments for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
Original NVD description (English source)
A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while parsing specially crafted SLDPRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27146)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS