CVE-2021-46162

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15048)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Siemens	Simcenter Femap	All versions < V2022.1.1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdfMitigation, Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-511/Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdfMitigation, Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-511/Third Party Advisory, VDB Entry

Timeline

Published: Feb 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-461636.1Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.CVE-2021-461648.8Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Repor CVE-2021-461657.8Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path mi CVE-2021-461666.5Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting t CVE-2021-461677.8An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of CVE-2021-461685.5Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c.CVE-2021-461695.5Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache.CVE-2021-461707.5An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string in js-lexer.c file.CVE-2021-461715.5Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.CVE-2021-461747.5Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37.CVE-2021-461796.5Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx CVE-2021-461955.5GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attacke