TI-2025-27224 Aliases CVE-2025-40762 GHSA-fg9q-q57h-p86x

Out-of-bounds write in Siemens Simcenter Femap V2406

LOW 33CWE-787Published 2025-08-12 · Updated 2025-08-12

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: High
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted STP file. This could allow an attacker to execute code in the context of the current process.(ZDI-CAN-26692)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00173 6th percentileScored 2026-11-07

Fix Fixed Simcenter Femap V2406 (Siemens): V2406.0003Simcenter Femap V2412 (Siemens): V2412.0002

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	Simcenter Femap V2406	before V2406.0003	V2406.0003	Patch available	CNA
Siemens	Simcenter Femap V2412	before V2412.0002	V2412.0002	Patch available	CNA

Simcenter Femap V2406 VendorSiemens Affected before V2406.0003 Fixed in V2406.0003 Patch available CNA
Simcenter Femap V2412 VendorSiemens Affected before V2412.0002 Fixed in V2412.0002 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:simcenter_femap::::::::	2406.0000 to before 2406.0003; 2412.0000 to before 2412.0002	Vulnerable	Siemens

cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* Versions 2406.0000 to before 2406.0003; 2412.0000 to before 2412.0002 Vulnerable ·Siemens

Remediation

Fix · CNA Simcenter Femap V2406 (Siemens) Fixed in V2406.0003
Fix · CNA Simcenter Femap V2412 (Siemens) Fixed in V2412.0002

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-08-12
Siemens Simcenter Femap V2406, Simcenter Femap V2412 V2406.0003, V2412.0002
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-27226 Out-of-bounds read in Siemens Simcenter Femap V2406Priority LOW 33
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-40762
2026-10-03 Alias added: GHSA-fg9q-q57h-p86x

References

Advisory 1

https://cert-portal.siemens.com/productcert/html/ssa-674084.html

TI-2022-11305 Out-of-bounds read in Siemens Simcenter Femap CVSS 3.1HIGH 8.8
TI-2021-21091 Stack-based buffer overflow in Siemens Simcenter Femap V2020.2 CVSS 3.1HIGH 7.8
TI-2021-21088 Stack-based buffer overflow in Siemens Simcenter Femap V2020.2 CVSS 3.1HIGH 7.8
TI-2021-21087 Stack-based buffer overflow in Siemens Simcenter Femap V2020.2 CVSS 3.1HIGH 7.8
TI-2021-21451 Stack-based buffer overflow in Siemens Simcenter Femap CVSS 3.1HIGH 7.8
TI-2021-21095 Out-of-bounds write in Siemens Simcenter Femap CVSS 3.1HIGH 7.8

See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences