CVE-2025-12659CWE-122

CVE-2025-12659

High · published May 12, 2026

CVSS v3.1

7.8

EPSS

Percentile

9.9

In the wild

Unconfirmed

What it is

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00204 · 9.9th percentile
Weakness: CWE-122 · Heap-based Buffer Overflow
Published: 2026-05-12T18:16Z

References (4)

https://cert-portal.siemens.com/productcert/html/ssa-870926.html · [email protected]https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-134-05.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-870926.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

EPSS history

Timeline

12 MAY 12:30Z
Heap-based buffer overflow in Siemens Simcenter Femap
cvelistv5