CVE-2025-40829

HighCVSS 7.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while parsing specially crafted SLDPRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27146)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2025
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-40839.1A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in CVE-2025-408306.7A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper author CVE-2025-408316.5A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of d CVE-2025-408337.5The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an CVE-2025-408345.7A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the i CVE-2025-408369.8Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute command CVE-2025-408378.8Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with CVE-2025-408387.5Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead t CVE-2025-40845.7Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command CVE-2025-408414.3Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Request Forgery (CSRF) vulnerability which, if exploited, can l CVE-2025-408426.1Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to CVE-2025-408437.8CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker vers