CVE-2026-59701: 
Siemens Simcenter Femap vulnerability analysis and mitigation

CVE-2026-59701 is an out-of-bounds read vulnerability in Siemens Simcenter Femap that can allow an attacker to execute arbitrary code in the context of the current process. It affects all versions of Simcenter Femap prior to V2606.0001 and was published on August 11, 2026. The vulnerability is classified as High severity with a CVSS v3.1 base score of 7.8 and a CVSS v4.0 base score of 7.3 (GitHub Advisory, Siemens Advisory).

The vulnerability is rooted in improper bounds checking during BMP file parsing within Simcenter Femap, classified as CWE-125 (Out-of-bounds Read). When the application processes a specially crafted BMP file, it reads data beyond the intended buffer boundary, which can be leveraged to achieve code execution within the Femap process context. Exploitation requires local access and user interaction — specifically, a victim must open a malicious BMP file — and no privileges are required on the part of the attacker (GitHub Advisory, Siemens Advisory).

Successful exploitation allows an unauthenticated local attacker to execute arbitrary code with the privileges of the Femap process, resulting in high impact to confidentiality, integrity, and availability of the vulnerable system. An attacker could access sensitive engineering data processed by Femap, modify files, or cause application crashes. The scope is limited to the vulnerable system itself, with no direct subsequent system impact identified (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Siemens Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA has published an ICS advisory (ICSA-26-225-11) covering this issue. The EPSS score is approximately 0.113% (2nd percentile), indicating a low near-term probability of exploitation. Exploitation is not automatable and requires user interaction, further limiting its attack surface.

1. Craft malicious BMP file: Create a specially crafted BMP file with malformed header or pixel data fields designed to trigger an out-of-bounds read in Simcenter Femap's BMP parser.
2. Deliver the file: Deliver the malicious BMP file to a target user via email attachment, shared network drive, USB media, or social engineering (e.g., disguising it as a legitimate engineering asset).
3. Induce user interaction: Convince the target user to open the crafted BMP file within Simcenter Femap (e.g., as part of a model or simulation project).
4. Trigger out-of-bounds read: When Femap parses the malformed BMP, the application reads beyond the intended buffer boundary, potentially corrupting memory in a controlled manner.
5. Achieve code execution: Leverage the memory corruption to redirect execution flow and run arbitrary code in the context of the Femap process, inheriting its privileges on the local system (GitHub Advisory, Siemens Advisory).

• File System: Unexpected BMP files in Femap project directories or user download/temp folders originating from untrusted sources; newly created or modified files in the Femap installation directory following a BMP file open event.
• Process: Unusual child processes spawned by the Simcenter Femap process (e.g., cmd.exe, powershell.exe, or network utilities); Femap process crashing or terminating unexpectedly after opening a BMP file.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing Simcenter Femap around the time a BMP file was opened; access violation or memory fault entries in Femap diagnostic logs.

Siemens has released a patch in Simcenter Femap version V2606.0001, and all users should upgrade to this version or later as the primary remediation (Siemens Advisory). As an interim workaround, organizations should restrict the handling of BMP files from untrusted or external sources and avoid opening BMP files of unknown origin within Femap. Additionally, applying the principle of least privilege and application whitelisting can help limit the impact of any potential code execution.

CISA published ICS advisory ICSA-26-225-11 in response to this vulnerability, highlighting its relevance to industrial control system environments where Simcenter Femap is commonly used (CISA ICS Advisory). No significant broader community or social media discussion has been identified beyond standard vulnerability aggregator coverage.