Which versions of Simcenter Femap are affected by EUVD-2026-56122?

Siemens Simcenter Femap users across engineering teams face code execution risk when opening specially crafted BMP files, potentially compromising design and simulation workflows.

How to fix or mitigate EUVD-2026-56122?

Within 24 hours: Enumerate all Siemens Simcenter Femap installations across the organization and restrict user ability to open BMP files from untrusted sources (external email, internet downloads, unvetted collaboration platforms). Within 7 days: Upgrade all instances to Siemens Simcenter Femap V2606.0001 or later; prioritize systems handling sensitive design intellectual property. Within 30 days: Confirm patch deployment across 100% of Femap installations and implement file-type restrictions via application settings or group policy to block BMP import from unauthorized channels.

Simcenter Femap EUVD-2026-56122

Q: What is the CVSS score of EUVD-2026-56122?

EUVD-2026-56122 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-59700 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 siemens

GHSA-xvvg-pjh6-4hr7

Buffer Overflow Information Disclosure Siemens Simcenter Femap

7.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

File-open trigger requires no privileges and no network access; UI:R and AV:L reflect mandatory local user interaction; AC:L chosen because crafting a malicious BMP imposes no runtime-environment prerequisite beyond the file itself.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 13:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 13:22 NVD

7.8 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 11, 2026 - 13:12 vuln.today

CVE Published

Aug 11, 2026 - 12:20 cve.org

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.

Technical ContextAI

Simcenter Femap (CPE: cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*) is a Siemens Computer-Aided Engineering (CAE) finite element analysis pre/post-processor targeting aerospace, automotive, and industrial engineering workflows. CWE-125 (Out-of-bounds Read) describes a condition where the application reads memory beyond the bounds of an allocated buffer. In this case the BMP image parser does not adequately validate field values in a crafted BMP header or pixel data stream, causing it to read past the intended buffer boundary. On modern platforms an out-of-bounds read can disclose heap or stack memory and, under exploit-friendly memory layouts, can be leveraged to redirect code execution - consistent with the VC:H/VI:H/VA:H impact ratings in the CVSS 4.0 vector. The attack vector is local (AV:L) because the victim must load the malicious file within the Femap process.

RemediationAI

The primary remediation is to upgrade Simcenter Femap to V2606.0001 or later, as confirmed by the Siemens PSIRT advisory SSA-584312 at https://cert-portal.siemens.com/productcert/html/ssa-584312.html. Vendor-released patch: V2606.0001. Where immediate patching is not feasible, compensating controls should include restricting the application from opening BMP files sourced from untrusted external parties by configuring file-type restrictions at the OS or application level, and training users not to open simulation or image files received via email or external file shares without verification. Disabling BMP import functionality entirely, if Femap provides a configurable file-type allowlist, would eliminate the attack surface at the cost of legitimate BMP-based workflows. Network-level controls are not relevant given the local attack vector.