Siemens Simcenter Femap Out-of-Bounds Read Vulnerabilities Patched

Siemens Simcenter Femap, a computer-aided engineering (CAE) software package, contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP format. According to a CISA Industrial Control Systems Advisory (ICSA-26-225-11) and corresponding Siemens security advisory, the flaws are tracked as CVE-2026-59700 and CVE-2026-59701.

Both vulnerabilities are out-of-bounds read issues occurring during the parsing of specially crafted BMP files. An attacker would need to convince a user to open a malicious BMP file with the affected application. Successful exploitation could lead to application crash or arbitrary code execution in the context of the current process.

The affected product versions are Simcenter Femap < V2606.0001. Siemens has released a new version and recommends users update to V2606.0001 or later to remediate the flaws. The vendor fix is available at https://support.sw.siemens.com/product/275652363/.

CVSS v3.1 base scores for both vulnerabilities are 7.8, classified as HIGH. The attack vector is local (AV:L), requiring low complexity (AC:L), no privileges (PR:N), user interaction (UI:R), with high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). Relevant CWEs are CWE-125 (Out-of-bounds Read).

CISA recommends minimizing network exposure for control system devices, ensuring they are not internet-accessible, and isolating control system networks from business networks. Users should apply the vendor patch and follow Siemens operational guidelines for industrial security.