CVE-2024-33654: Siemens Simcenter Femap RCE Vulnerability

CVE-2024-33654 Overview

CVE-2024-33654 is an out-of-bounds read vulnerability in Siemens Simcenter Femap affecting all versions prior to V2406. The flaw resides in the BMP file parsing logic, where the application reads past the end of an allocated structure when processing specially crafted bitmap files. An attacker can leverage this condition to execute code in the context of the current process. Exploitation requires user interaction, as a target must open a malicious BMP file within the affected application. Siemens documented the issue in advisory SSA-064222 and released a fixed build in V2406.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the Simcenter Femap process, enabling access to any data and privileges held by the user running the application.

Affected Products

Siemens Simcenter Femap — all versions prior to V2406
Component: siemens:simcenter_femap
Weakness class: [CWE-125] Out-of-Bounds Read

Discovery Timeline

2024-07-09 - CVE-2024-33654 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33654

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the BMP image parser used by Simcenter Femap. When the parser processes a bitmap file, it dereferences memory beyond the bounds of an allocated structure. This condition arises from insufficient validation of header fields or size metadata contained inside the BMP file.

The out-of-bounds read exposes adjacent heap memory to attacker-influenced code paths. Depending on the memory layout at exploitation time, the read can be pivoted into control-flow hijacking. Siemens states the impact includes code execution in the context of the current user process. Attack complexity is elevated because reliable exploitation depends on memory layout and specific parser state.

Root Cause

The root cause is missing bounds checking during structured parsing of BMP file data. The parser trusts length or offset fields inside the file rather than validating them against the size of the underlying buffer or structure. This mismatch causes the read pointer to advance past the allocation boundary, classifying the issue under [CWE-125].

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious BMP file and delivers it through phishing, a shared file store, or a project archive. When a Simcenter Femap user opens the file or a model referencing it, the vulnerable parser processes the crafted structure and triggers the out-of-bounds read. No authentication to the application is required beyond the user's own session.

Code execution details are not documented in the public advisory. See the Siemens Security Advisory SSA-064222 for vendor technical detail.

Detection Methods for CVE-2024-33654

Indicators of Compromise

Unexpected femap.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe following the opening of a BMP or CAD project file.
Crash dumps or Windows Error Reporting events referencing access violations inside the Simcenter Femap image parsing modules.
BMP files arriving with anomalous header sizes, malformed biSize or biBitCount fields, or truncated pixel data delivered from external senders.

Detection Strategies

Alert on Simcenter Femap process crashes correlated with recent file-open activity on .bmp inputs.
Hunt for outbound network connections initiated by femap.exe, which typically does not require external network egress on engineering workstations.
Inspect email and file-share gateways for BMP attachments delivered alongside Femap project files (.modfem, .neu) to engineering users.

Monitoring Recommendations

Monitor endpoint telemetry on engineering workstations for anomalous child processes spawned by femap.exe.
Track file access events where Simcenter Femap opens BMP files from user-writable or network-shared paths.
Forward application crash telemetry into a central analytics platform to correlate parser faults across the fleet.

How to Mitigate CVE-2024-33654

Immediate Actions Required

Upgrade all Simcenter Femap installations to V2406 or later, as directed in Siemens advisory SSA-064222.
Instruct engineering users to open BMP and project files only from trusted internal sources until patching is complete.
Inventory hosts running vulnerable Simcenter Femap builds and prioritize patch deployment on internet-connected workstations.

Patch Information

Siemens has released Simcenter Femap V2406, which remediates the out-of-bounds read in the BMP parser. Administrators should download the fixed version from the Siemens support portal. Reference Siemens Security Advisory SSA-064222 for verified fix guidance and file hashes.

Workarounds

Restrict Simcenter Femap users from opening BMP files originating outside the organization until V2406 is deployed.
Apply application allow-listing to prevent femap.exe from launching child processes such as command interpreters.
Run Simcenter Femap under least-privilege user accounts to limit the impact of code execution in the process context.

bash

# Configuration example
# Confirm the installed Simcenter Femap build on Windows workstations
powershell -Command "Get-ItemProperty 'HKLM:\Software\Siemens\Femap*' | Select-Object DisplayName, DisplayVersion"

# Block inbound BMP attachments at the mail gateway (example ruleset entry)
# rule: block-bmp-external
#   match: sender.domain != "corp.local" AND attachment.extension == "bmp"
#   action: quarantine