EUVD-2026-56123
GHSA-4v9w-wpw8-v5mc
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-open vector with user interaction required; AC:H reflects reliability barrier for code execution from OOB read; no prior auth needed to open a file.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.
AnalysisAI
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Technical ContextAI
Simcenter Femap is a Siemens CAE/FEA (Computer-Aided Engineering / Finite Element Analysis) pre- and post-processor used in aerospace, automotive, and defense engineering workflows (CPE: cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-125 (Out-of-Bounds Read): the BMP file parser reads memory beyond the allocated buffer boundary, likely due to missing or insufficient validation of image header fields such as width, height, bit depth, or color table size. While CWE-125 is classified as an information-disclosure primitive, the vendor explicitly notes that it can allow code execution in the current process context - consistent with scenarios where an attacker controls the out-of-bounds data to influence subsequent pointer dereferences or overwrites adjacent heap/stack metadata. The CVSS 4.0 supplemental tags include both 'Information Disclosure' and 'Buffer Overflow', corroborating a dual-stage exploit primitive (read-then-control) common in file-format parsing vulnerabilities.
RemediationAI
The primary remediation is to upgrade Simcenter Femap to version V2606.0001 or later, as documented in Siemens Product CERT advisory SSA-584312 at https://cert-portal.siemens.com/productcert/html/ssa-584312.html. If immediate patching is not feasible, compensating controls should focus on file provenance: configure the operating system or endpoint security tooling to block or quarantine BMP files received from untrusted external sources (email attachments, web downloads) before they reach workstations running Femap. Educate engineering users not to open BMP assets from unverified parties in Femap workflows. Network segmentation of engineering workstations from the broader corporate network reduces lateral movement opportunity if a workstation is compromised. Note that blocking BMP files broadly may disrupt legitimate workflows that rely on BMP textures or image references in simulation models - this trade-off should be assessed per-team before deployment.
More in Simcenter Femap
View allOut-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code executi
Arbitrary code execution in Siemens Simcenter Femap (all versions before V2512.0003) arises from a heap-based memory cor
A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.2). Rated high severity (CVSS 8.8), this
Improper TLS certificate validation in Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Soli
Arbitrary code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds write flaw
Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered
Heap-based buffer overflow in Simcenter Femap and Nastran versions prior to V2512 allows local attackers to achieve arbi
Out-of-bounds read in Simcenter Femap and Nastran versions prior to V2512 during NDB file parsing enables local code exe
Simcenter Femap and Nastran versions prior to 2512 are vulnerable to out-of-bounds memory reads when processing maliciou
Arbitrary code execution in Simcenter Femap and Nastran versions prior to 2512 results from an out-of-bounds read when p
A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). Rated high severity (CVSS 7.8), this
A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). Rated high severity (CVSS 7.8), this
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today