ZDI-CAN-27389: ZDI-26-316: Siemens Simcenter Femap IPT File Parsing Memory Corruption Remote Code Execution Vulnerability

Published May 12, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Simcenter Femap. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-12659.

Affected Software

1 affected component

Siemens Simcenter Femap

Event History

May 12, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-27389?

ZDI-CAN-27389 has a critical severity rating due to its potential for remote code execution.

How do I fix ZDI-CAN-27389?

To fix ZDI-CAN-27389, update Siemens Simcenter Femap to the latest version that addresses this vulnerability.

What impact does ZDI-CAN-27389 have on my system?

If exploited, ZDI-CAN-27389 allows an attacker to execute arbitrary code, potentially compromising the entire system.

Does ZDI-CAN-27389 require user interaction to exploit?

Yes, ZDI-CAN-27389 requires user interaction to exploit as it involves file parsing.

What software is affected by ZDI-CAN-27389?

ZDI-CAN-27389 affects Siemens Simcenter Femap installations.