CVE-2026-59701: Simcenter Femap RCE Vulnerability

CVE-2026-59701 Overview

CVE-2026-59701 is an out-of-bounds read vulnerability in Siemens Simcenter Femap, affecting all versions prior to V2606.0001. The flaw resides in the BMP file parsing logic and is triggered when the application processes a specially crafted bitmap image. An attacker who convinces a user to open a malicious BMP file can read memory outside the intended bounds and potentially execute arbitrary code in the context of the current process. The issue is tracked under CWE-125: Out-of-bounds Read and disclosed in Siemens Security Advisory SSA-584312.

Critical Impact
Successful exploitation allows code execution under the privileges of the Simcenter Femap user, enabling data theft, lateral movement, or persistence on engineering workstations.

Affected Products

Siemens Simcenter Femap — all versions prior to V2606.0001

Discovery Timeline

2026-08-11 - CVE-2026-59701 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-59701

Vulnerability Analysis

Simcenter Femap is a finite element modeling and post-processing application used in mechanical engineering workflows. The vulnerable code path is invoked when the application parses BMP image files, which can be embedded in models, referenced by projects, or opened directly by a user.

The defect is an out-of-bounds read [CWE-125]. When Femap processes a malformed BMP header or pixel data section, the parser reads memory beyond the allocated buffer. This can leak adjacent memory contents and, depending on process state, corrupt internal structures used for later control-flow decisions. Siemens states the condition can allow attackers to execute code in the context of the current process.

Exploitation requires local file access and user interaction because the victim must open the crafted BMP within Simcenter Femap. Attackers typically deliver such files through phishing, shared engineering repositories, or supply-chain document exchange.

Root Cause

The root cause is missing or insufficient bounds validation while parsing structured fields inside the BMP format. BMP files contain length and offset fields in the file header, DIB header, and color table that must be validated before dereferencing buffers. When these fields are trusted without verification, the parser reads past allocation boundaries.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a BMP file with manipulated header fields and delivers it to a Simcenter Femap operator. When the file is opened or imported, the parsing routine triggers the out-of-bounds read and may pivot to code execution. See Siemens Security Advisory SSA-584312 for vendor details.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-59701

Indicators of Compromise

Unexpected crashes or hangs of femap.exe shortly after a BMP file is opened or a project is imported.
Malformed BMP files present in engineering project directories, email attachments, or shared drives that reference Simcenter Femap workflows.
Child processes spawned from femap.exe such as command interpreters, PowerShell, or scripting hosts.

Detection Strategies

Monitor process telemetry for Simcenter Femap creating unexpected child processes or performing network connections shortly after file open events.
Correlate Windows Error Reporting events for femap.exe with recent file access on BMP artifacts to surface exploitation attempts.
Apply YARA or file-inspection rules to flag BMP files with inconsistent header size, pixel offset, or biSize fields on engineering file shares.

Monitoring Recommendations

Enable full command-line and image-load logging on workstations running Simcenter Femap to capture post-exploitation behavior.
Forward endpoint telemetry to a centralized analytics platform to enable retrospective hunting across engineering hosts.
Alert on modifications or new BMP files introduced into shared CAD/CAE project directories from external sources.

How to Mitigate CVE-2026-59701

Immediate Actions Required

Upgrade Simcenter Femap to V2606.0001 or later on all affected engineering workstations.
Restrict Simcenter Femap to opening files from trusted, controlled sources; block BMP attachments from untrusted external senders.
Instruct users not to open BMP files received from unknown or unverified origins within Simcenter Femap.

Patch Information

Siemens has released a fixed build in Simcenter Femap V2606.0001. Refer to Siemens Security Advisory SSA-584312 for the official patch details and download instructions.

Workarounds

Avoid opening BMP files from untrusted sources in Simcenter Femap until the patch is applied.
Apply the principle of least privilege so Simcenter Femap runs under a standard user account rather than a privileged one.
Segment engineering workstations from general corporate email and web browsing to reduce the delivery paths for crafted files.

bash

# Example: block untrusted BMP delivery to engineering hosts via file share ACLs
# Deny write access to BMP files from non-engineering groups
icacls "\\fileserver\CAE_Projects" /deny "Domain Users:(OI)(CI)(WD)"
icacls "\\fileserver\CAE_Projects" /grant "CAE_Engineers:(OI)(CI)(M)"