Multiple File Parsing Vulnerabilities in Simcenter Femap and Nastran Before V2512

An attacker could craft a malicious CAE model file that crashes the engineering workstation running Femap or Nastran, disrupting simulation and analysis workflows. In the worst case, arbitrary code execution could allow the attacker to compromise the workstation and access sensitive CAE data or network resources.

Engineering teams and design offices using Siemens Simcenter Femap or Nastran for finite element analysis and simulation should care about this vulnerability. It affects CAE (computer-aided engineering) workstations used for structural analysis, thermal analysis, and simulation in manufacturing, aerospace, automotive, and infrastructure sectors. Anyone who receives CAE model files from external sources or untrusted origins is at risk.

An attacker creates a malicious NDB or XDB file (Nastran/Femap model formats) and tricks an engineer into opening it via email or file sharing. When the file is opened in Femap or Nastran, the parser attempts to read malformed file headers or record structures, triggering a buffer overflow or out-of-bounds memory access. This allows the attacker to either crash the application or execute arbitrary code with the user's privileges on the engineering workstation.