CVE-2025-12659

CWE-122Published: May 12, 2026· Updated: May 12, 2026

7.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.0th

Official Description

The affected applications contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27349, ZDI-CAN-27389)

NVD Source

Technical Analysis

CVE-2025-12659 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (P) is needed, which slightly reduces the risk of mass automated attacks.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityHigh

Privileges Req.None

User InteractionP

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2025-12659

Siemens Simcenter Femap

CISA Alerts· May 14, 2026

View CSAF Summary Simcenter Femap is affected by heap based buffer overflow vulnerability in Datakit library that could be triggered when the application reads files in IPT format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version. The following versions of Siemens Simcenter Femap are affected: Simcenter Femap vers:intdot/<2512.0003 CVSS Vendor Equipment Vulnerabilities v3 7.8 Siemens Siemens Simcenter Femap Heap-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing Countrie [xlite_meta score:73 src:CISA Alerts xlite_fp:9cdfc3b7b314b1a36ee02b3bc3e0a47f419f277deaa4ee74acfae81aa57d152e]