CVE-2025-12659: Heap-based buffer overflow in Siemens Simcenter Femap

Awaiting analysis

Published 12-05-2026Last modified 09-06-2026

Vulnerability summary

CVE-2025-12659 is a high (CVSS 7.8) Heap-based Buffer Overflow vulnerability in siemens simcenter_femap. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.9% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.20%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

12-05-2026
PublishedVulnerability first disclosed.
09-06-2026
Last modifiedVulnerability information updated.

Description

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.07.3v3.17.8

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.20% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected systems

Siemens1 product

simcenter_femap< V2512.0003

1 vendor · 1 product

References

3 links