CVE-2025-40764

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
SiemensSimcenter Femap V2406< V2406.0003
SiemensSimcenter Femap V2412< V2412.0002

References

Timeline

Published
Aug 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-407659.8A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application containCVE-2025-407665.5A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs dockCVE-2025-407677.8A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs dockCVE-2025-407687.8A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes aCVE-2025-407697.4A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application uses a CoCVE-2025-40777.8A vulnerability classified as critical was found in code-projects School Billing System 1.0. This vulnerability affects the function searchrCVE-2025-407707.0A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions). The affected application uses a monitorinCVE-2025-407719.8A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6CVE-2025-407726.1A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-CVE-2025-407735.3A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access controCVE-2025-407744.4A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted CVE-2025-407757.5When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value