CVE-2026-59700: 
Siemens Simcenter Femap vulnerability analysis and mitigation

CVE-2026-59700 is an out-of-bounds read vulnerability in Siemens Simcenter Femap that can allow an attacker to execute arbitrary code in the context of the current process. It affects all versions of Simcenter Femap prior to V2606.0001 and is triggered by parsing specially crafted BMP files. The vulnerability was published on August 11, 2026, with a patch available in version V2606.0001. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory, Siemens CERT).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), occurring in Simcenter Femap's BMP file parser, which reads data beyond the intended buffer boundary when processing specially crafted BMP files. This memory safety flaw can be leveraged to achieve code execution within the context of the running Femap process. Exploitation requires local access and user interaction — specifically, a victim must open a malicious BMP file within the application. No privileges are required on the part of the attacker prior to exploitation (GitHub Advisory, Siemens CERT).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Simcenter Femap process, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker could access sensitive engineering or simulation data managed by the application, modify or corrupt project files, or cause the application to crash. The scope of impact is limited to the vulnerable system itself, with no direct impact on subsequent systems (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The vulnerability requires local access and user interaction (opening a malicious BMP file), which limits its attack surface. The EPSS score is approximately 0.113% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA has published an ICS advisory (ICSA-26-225-11) (CISA ICS Advisory, GitHub Advisory).

1. Craft a malicious BMP file: Create a specially crafted BMP file designed to trigger an out-of-bounds read in Simcenter Femap's BMP parser, potentially by manipulating BMP header fields (e.g., image dimensions, color table size, or pixel data offsets) to cause the parser to read beyond the allocated buffer.
2. Deliver the file to the target: Use social engineering, phishing, or place the malicious BMP file in a shared directory accessible to a Simcenter Femap user, exploiting the trust users place in engineering file formats.
3. Induce the victim to open the file: Convince the target user to open the crafted BMP file within Simcenter Femap (e.g., as a texture or image import), triggering the vulnerable parsing code.
4. Trigger out-of-bounds read: The BMP parser reads data beyond the intended buffer boundary, potentially exposing memory contents or corrupting adjacent memory in a way that enables control flow hijacking.
5. Achieve code execution: If memory layout conditions are favorable, the out-of-bounds read leads to code execution within the context of the Femap process, granting the attacker the same privileges as the running application (GitHub Advisory, Siemens CERT).

• File System: Presence of unexpected or unsolicited BMP files in directories accessible to Simcenter Femap users; BMP files with anomalous header values (e.g., inconsistent image dimensions or oversized color tables).
• Process: Simcenter Femap process (femap.exe) spawning unexpected child processes (e.g., cmd.exe, powershell.exe, network utilities) or crashing with access violation errors.
• Logs: Application crash logs or Windows Event Logs recording access violation exceptions (e.g., Event ID 1000) originating from the Femap process during BMP file parsing.
• Network: Unexpected outbound network connections from the Femap process to external IP addresses following the opening of a BMP file.

Siemens has released a patch in Simcenter Femap version V2606.0001, which resolves this vulnerability. Users should upgrade to V2606.0001 or later as the primary remediation. Until patching is feasible, organizations should restrict user access to Simcenter Femap, implement controls to prevent opening BMP files from untrusted sources, and educate users not to open files received from unknown or unverified parties (Siemens CERT, GitHub Advisory).