Multiple Local Code Execution Vulnerabilities in Questa and ModelSim

A local attacker with user-level access to a workstation running Questa or ModelSim could execute arbitrary code with elevated privileges, potentially compromising engineering data, simulation integrity, or the design environment itself.

Design and simulation engineers using Questa or ModelSim on their workstations should prioritize this update. This affects organizations in any sector that use Siemens EDA tools for FPGA, ASIC, or hardware design verification, including utilities designing custom control systems.

An attacker with local access to a workstation running a vulnerable version of Questa or ModelSim could exploit the code injection vulnerability through user interaction (such as opening a project file or simulation model) to execute arbitrary code and escalate to higher privileges.