Full Report
Simcenter Femap contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version.
Analysis Summary
# Vulnerability: BMP File Parsing Vulnerabilities in Simcenter Femap
## CVE Details
- **CVE ID:** CVE-2026-59700, CVE-2026-59701
- **CVSS Score:**
- CVSS v3.1: 7.8 (High)
- CVSS v4.0: 7.3 (High)
- **CWE:** CWE-125 (Out-of-bounds Read)
## Affected Systems
- **Products:** Simcenter Femap
- **Versions:** All versions prior to V2606.0001
- **Configurations:** Systems where the application is used to open or process image files (specifically BMP format).
## Vulnerability Description
Simcenter Femap contains two distinct vulnerabilities related to how the application parses BMP (Bitmap) files. Due to insufficient bounds checking during the parsing process, the application is susceptible to out-of-bounds read errors. While "Out-of-bounds Read" typically implies information disclosure or crashes, Siemens notes that these specific flaws could be leveraged to achieve arbitrary code execution in the context of the current process.
## Exploitation
- **Status:** Not exploited in the wild (Reported via coordinated disclosure by Michael Heinzl). No public PoC currently listed.
- **Complexity:** Low (CVSS v3.1) / High (CVSS v4.0) - requires a specifically crafted malicious file.
- **Attack Vector:** Local (Requires a user to be tricked into opening a malicious BMP file; User Interaction is Required).
## Impact
- **Confidentiality:** High (Potential for arbitrary code execution and data access).
- **Integrity:** High (Potential for unauthorized modification of system files/memory).
- **Availability:** High (Can lead to application crashes and denial of service).
## Remediation
### Patches
- **Simcenter Femap V2606.0001:** Siemens recommends updating to version V2606.0001 or any subsequent later versions to resolve these vulnerabilities.
### Workarounds
- **General Security Best Practices:**
- Do not open untrusted or suspicious files, especially those received from unknown sources.
- Restrict network access to critical engineering workstations.
- Operate the software within a protected IT environment following Siemens' operational guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Application crashes (Access Violations) specifically occurring when loading or previewing BMP files.
- **Detection Methods:** Security teams can monitor for unusual child processes spawned by the `femap.exe` process or utilize EDR tools to detect memory corruption attempts associated with image parsing libraries.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-584312[.]pdf
- **Siemens Support Portal:** hxxps[://]support[.]sw[.]siemens[.]com/product/275652363/
- **Siemens Industrial Security:** hxxps[://]www[.]siemens[.]com/industrialsecurity