Arbitrary Code Execution in Siemens Simcenter Femap

Siemens Simcenter Femap versions prior to V2606.0001 contain two vulnerabilities, CVE-2026-59700 and CVE-2026-59701, stemming from improper file parsing of BMP format images. These flaws are classified as out-of-bounds read vulnerabilities (CWE-125). An attacker can exploit these issues by providing a user with a specially crafted BMP file. If the victim opens the malicious file using the affected software, the application may crash or execute arbitrary code in the context of the user process. These vulnerabilities carry a CVSS score of 7.8 and are particularly relevant to the Critical Manufacturing sector where Simcenter Femap is deployed for engineering simulation tasks.

Impact

Successful exploitation allows for remote code execution within the security context of the user running the software, potentially leading to unauthorized data access, system disruption, or further compromise of engineering workstations. The impact is categorized as high given the potential for full compromise of the local application process.

Recommendation

• Immediately update Siemens Simcenter Femap to version V2606.0001 or later to remediate CVE-2026-59700 and CVE-2026-59701.
• Implement file access controls and restrict the opening of untrusted files within engineering environments to mitigate the risk of user-driven exploitation.
• Audit endpoint software to identify legacy installations of Siemens Simcenter Femap that require patching.