Is CVE-2025-12659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-12659 being exploited in the wild.

How severe is CVE-2025-12659?

High severity, with a CVSS score of 7.8, published 12 May 2026.

Which products and versions are affected?

Siemens Simcenter Femap < 2512.0003, All versions < V2512.0003.

Is there a fix for CVE-2025-12659?

A patch was published on 2026-05-12: Siemens released version V2512.0003 to address the flaw Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-12659 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-12659?

Check whether you run Siemens Simcenter Femap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-12659: Siemens Simcenter Femap heap overflow in Datakit library

Q: Is there a fix for CVE-2025-12659?

A patch was published on 2026-05-12: Siemens released version V2512.0003 to address the flaw Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-12659 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2025-12659?

Check whether you run Siemens Simcenter Femap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-12659 · Severity: high · CVSS 7.8 · Published 2026-05-12

Siemens Simcenter Femap, an engineering tool used for creating and inspecting complex simulation models, is vulnerable to a memory corruption flaw. An attacker could exploit this by tricking a user into opening a specially crafted IPT file, potentially leading to unauthorized code execution on the user's system. This could result in a full system compromise, data theft, or disruption of engineering operations.

Technologies: Siemens Simcenter Femap. Vendors: Siemens.

Quick answers

Is CVE-2025-12659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-12659 being exploited in the wild.
How severe is CVE-2025-12659?: High severity, with a CVSS score of 7.8, published 12 May 2026.
Which products and versions are affected?: Siemens Simcenter Femap < 2512.0003, All versions < V2512.0003.
Is there a fix for CVE-2025-12659?: A patch was published on 2026-05-12: Siemens released version V2512.0003 to address the flaw Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12659 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-12659?: Check whether you run Siemens Simcenter Femap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the Datakit library used by Siemens Simcenter Femap. The vulnerability is triggered during the parsing of specially crafted IPT (Autodesk Inventor) files. An attacker can exploit this by providing a malicious file to a user; when the application attempts to process the file, memory corruption occurs. This can be leveraged to execute arbitrary code in the context of the current process. The attack requires user interaction (opening the file) and local access to the file system. Siemens has addressed this in version V2512.0003.

Affected products

Siemens Simcenter Femap All versions < V2512.0003

Timeline

2026-05-12: advisory: Initial Siemens SSA-870926 advisory published
2026-05-12: patched: Siemens released version V2512.0003 to address the flaw
2026-05-14: advisory: CISA ICSA-26-134-05 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.