Simcenter Femap CVE-2026-59701

Exploitation requires that a user open a specially crafted BMP file within an unpatched version of Simcenter Femap (all versions prior to V2606.0001). The vulnerability is triggered solely through the application's BMP file parser - no special server configuration, network service, or non-default feature flag is required; however, BMP files must actually be processed by Femap (i.e., opened or imported as part of a simulation workflow). The CVSS 4.0 vector (AV:L) confirms that the attack is local: the malicious file must reside on or be accessible from the local system. Passive user interaction (UI:P) is mandatory - the file does not self-execute and must be deliberately opened by the target user. Attack complexity is rated High (AC:H), indicating that reliable code execution - as opposed to a crash - depends on additional conditions such as specific heap layout or memory state. No network-accessible attack surface is involved; remote attackers must first deliver the file via social engineering or a secondary delivery mechanism.

The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:P) yields a score of 7.3, indicating a meaningful but bounded risk. The local attack vector (AV:L) and high attack complexity (AC:H) significantly constrain opportunistic exploitation: an attacker cannot reach the vulnerability over the network and must overcome reliability or heap-layout challenges to achieve consistent code execution rather than a simple crash. User interaction (UI:P) adds a social-engineering dependency. No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, suggesting exploitation remains theoretical or limited to targeted adversaries with significant reverse-engineering capability. For organizations in engineering-intensive industries (defense, aerospace, automotive), the risk is elevated relative to the base score due to the sensitivity of FEA model data resident in memory. For all others, the niche deployment footprint of Femap further limits aggregate exposure. The discrepancy between the PR:N metric (no privileges required to open the file) and the local attack vector is not a conflict - it reflects the standard file-lure attack pattern where no OS-level privilege escalation is needed prior to exploitation.

An attacker targeting an engineering firm embeds a specially crafted BMP file in a plausible-looking project archive or sends it via spear-phishing to a CAE engineer. When the engineer opens the file in Simcenter Femap as part of normal model preparation, the BMP parser reads beyond its allocated buffer, and through heap-layout manipulation the attacker achieves code execution within the Femap process, gaining access to in-memory FEA model data and the engineer's local file system. No public proof-of-concept is known at time of analysis, so reliable exploitation likely requires custom exploit development against the target version.