Siemens Femap patches BMP parsing flaws
Two out-of-bounds read vulnerabilities in Siemens Simcenter Femap's BMP file parsing could allow arbitrary code execution via malicious files.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Siemens has patched two out-of-bounds read vulnerabilities (CVE-2026-59700 and CVE-2026-59701) in Simcenter Femap, its finite element analysis software used in critical manufacturing environments worldwide. Both flaws stem from improper bounds checking when the application parses specially crafted BMP image files, and could cause a crash or potentially allow an attacker to execute arbitrary code in the context of the current process if a user is tricked into opening a malicious file.
The vulnerabilities affect all versions of Simcenter Femap prior to V2606.0001. Siemens ProductCERT reported the issues to CISA, and a fix is available by updating to the patched version. There is no evidence of active exploitation; this is a standard vendor-disclosed vulnerability advisory requiring a local file-based attack vector (social engineering to open a malicious BMP file), rather than a remotely exploitable network flaw.
CISA republished the Siemens advisory as part of its routine ICS vulnerability disclosure process, recommending standard mitigations such as minimizing network exposure of control system devices, isolating ICS networks behind firewalls, and using secure remote access methods like VPNs where necessary.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-11
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs