CVE-2025-12659 is a heap-based buffer overflow vulnerability (CWE-122) in Siemens Simcenter Femap. The flaw arises during the parsing of specially crafted IPT files, leading to memory corruption that could enable arbitrary code execution in the context of the current process. The CVSS 4.0 vector indicates local attack vector with high complexity and no privileges required, but user interaction is needed. The vulnerability has high impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the user running Simcenter Femap. This could lead to compromise of the affected system's confidentiality, integrity, and availability. The attack requires local access and user interaction, with high attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening IPT files from untrusted sources and consider restricting access to the affected software. Monitor Siemens' official channels for updates and patches.