CVE-2026-59086
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Simcenter Femap and Simcenter Nastran (versions before V2606) contain a stack overflow vulnerability while parsing specially crafted strings as arguments for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
Risk Assessment
Risk includes remote code execution in the context of the application process, potentially leading to system compromise or data integrity issues.
Recommendation
Upgrade Simcenter Femap and Simcenter Nastran to version V2606 or later and restrict access to the applications.
Other vulnerabilities in Simcenter Femap
See all- CVE-2026-59701High
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2026-59700High
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2025-40829High
A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected application contains an uninitialized memory vulnerability while parsing specially crafted SLDPRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27146)
Original NVD description (English source)
A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS