CVE-2026-23719: Siemens Simcenter Femap Buffer Overflow

CVE-2026-23719 Overview

CVE-2026-23719 is a heap-based buffer overflow [CWE-122] affecting Siemens Simcenter Femap and Simcenter Nastran in all versions prior to V2512. The flaw resides in the application's parser for NDB files. An attacker who convinces a user to open a specially crafted NDB file can trigger memory corruption on the heap. Successful exploitation allows arbitrary code execution in the context of the current process.

The vulnerability requires local file access and user interaction, but no authentication. Siemens documented the issue in security advisory SSA-965753.

Critical Impact
Attackers can execute arbitrary code with the privileges of the user running Simcenter Femap or Nastran by delivering a malicious NDB file through phishing, shared engineering repositories, or supply chain channels.

Affected Products

Siemens Simcenter Femap — all versions prior to V2512
Siemens Simcenter Nastran — all versions prior to V2512
File parser component handling .NDB (Nastran database) files

Discovery Timeline

2026-02-10 - CVE-2026-23719 published to the National Vulnerability Database
2026-02-10 - Siemens publishes advisory SSA-965753
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-23719

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow classified under [CWE-122]. It occurs when Simcenter Femap and Simcenter Nastran parse NDB files containing malformed or oversized field values. The parser allocates a heap buffer based on attacker-influenced size assumptions and then writes data past the allocated boundary.

Writing beyond the heap buffer corrupts adjacent allocator metadata or in-band object structures. Skilled attackers can shape the heap layout to overwrite function pointers, vtables, or return-oriented programming gadgets. This converts a memory corruption primitive into arbitrary code execution within the process.

The attack surface is local file parsing, and exploitation requires the victim to open the malicious file. Engineering workstations frequently process third-party CAD and simulation data, making this a practical delivery channel.

Root Cause

The root cause is missing or incorrect bounds validation while deserializing record structures inside NDB files. The application trusts size or length fields supplied in the file before copying associated data into a fixed or under-allocated heap region. The mismatch between declared size and actual buffer capacity produces the overflow.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts an NDB file containing manipulated header or record fields. The file is delivered through email attachments, shared network drives, project archives, or compromised vendor packages. When the engineer opens the file in Femap or Nastran, the parser triggers the overflow and the attacker's payload executes in the user context.

No network exposure is needed and no credentials are required on the target system. The attack runs with the privileges of the logged-in engineering user, which on workstations is often equivalent to local administrator.

Detection Methods for CVE-2026-23719

Indicators of Compromise

Unexpected child processes spawned by femap.exe or Nastran executables, especially shells (cmd.exe, powershell.exe) or scripting hosts.
Crashes or Windows Error Reporting events referencing heap corruption in the Simcenter process modules.
NDB files originating from untrusted senders or anomalous external paths opened on engineering workstations.
Outbound network connections initiated by the Femap or Nastran process to non-Siemens infrastructure.

Detection Strategies

Hunt for process lineage where Simcenter Femap or Nastran is the parent of interactive command interpreters or LOLBins.
Inspect crash dumps from engineering workstations for access violations within NDB parsing routines.
Apply YARA or content rules to flag NDB files with malformed headers or anomalous record lengths in mail and file-share gateways.

Monitoring Recommendations

Forward EDR process telemetry and Windows Error Reporting events from CAE workstations into a centralized analytics platform for correlation.
Track file write and execution events for .ndb files received from external sources, and alert when such files are opened immediately after delivery.
Monitor egress traffic from engineering hosts and baseline expected destinations for Simcenter components.

How to Mitigate CVE-2026-23719

Immediate Actions Required

Upgrade Simcenter Femap and Simcenter Nastran to version V2512 or later on all engineering workstations.
Inventory hosts running affected versions and prioritize systems that process externally sourced NDB files.
Instruct engineers to validate the origin of NDB files before opening and to reject files from unverified senders.
Restrict user privileges on workstations so Simcenter processes do not run with administrative rights.

Patch Information

Siemens addressed CVE-2026-23719 in Simcenter Femap V2512 and Simcenter Nastran V2512. Refer to Siemens Security Advisory SSA-965753 for fixed version details and download links. Apply the update through the standard Siemens product distribution channels.

Workarounds

Until patching is complete, open NDB files only from trusted internal sources and project repositories.
Use application allow-listing and exploit protection features such as Windows Defender Exploit Guard or equivalent to enforce ASLR, DEP, and CFG on Simcenter binaries.
Isolate engineering workstations from general-purpose user mail flow by routing CAE file exchange through a dedicated, scanned transfer system.

bash

# Example: enforce Windows exploit protection on Femap binary
Set-ProcessMitigation -Name femap.exe -Enable DEP,ForceRelocateImages,BottomUp,SEHOP,TerminateOnError