Cisco Talos Discloses Code Injection in OpenFOAM 2506 (CVE-2025-61982)

--- Key Information Overview Vulnerability ID: TALOS-2025-2292 CVE ID: CVE-2025-61982 Affected Version: OpenCFD OpenFOAM 2506 CVSS Score: 7.8 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE ID: CWE-94 - Improper Control of Generation of Code (Code Injection) Vulnerability Details Summary: - OpenFOAM 2506 contains a remote code execution vulnerability in its Code Stream feature. Attackers can trigger the vulnerability by providing malicious simulation files, leading to arbitrary code execution. Vulnerability Details: - OpenFOAM is an open-source computational fluid dynamics (CFD) software widely used in academic and industrial environments. - The directive in its dictionary files allows embedding C++ code, including calls to sensitive system functions such as . This enables attackers to gain remote access to the target machine and execute arbitrary code. - By default, the option in configuration files is set to , allowing users to execute arbitrary code from untrusted sources during simulation runs. Mitigation Recommendation: - Set the option to in OpenFOAM configuration files, for example: Timeline: - 2025-11-10: Initial contact with vendor - 2025-11-17: Vulnerability disclosed to vendor - 2025-11-25: Issue created in vendor’s vulnerability tracker - 2025-12-03: Vendor response - 2025-12-08: Talos response - 2025-12-11: Vendor response with mitigation advice - 2025-12-18: Talos feedback - 2026-02-04: Request for status update to vendor - 2026-02-04: Vendor response - 2026-02-11: Talos response and announcement of upcoming release date - 2026-02-18: Public disclosure released Discoverer: Dimitrios Tatsis of Cisco Talos --- Summary: This report details a remote code execution vulnerability discovered in OpenFOAM 2506. Users are advised to promptly adjust their configurations according to the official recommendations to mitigate potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Talos Discloses Code Injection in OpenFOAM 2506 (CVE-2025-61982)