Siemens Simcenter Femap buffer overflows via STP BMP files
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two buffer overflow bugs in Siemens Simcenter Femap allow code execution when parsing specially crafted STP or BMP files.
Siemens Simcenter Femap versions 2406 and 2412 contain two memory corruption vulnerabilities that could allow local code execution. CVE-2025-40762 is an out-of-bounds write triggered by parsing a malicious STP file, while CVE-2025-40764 is an out-of-bounds read in BMP file parsing. Both carry a CVSS 7.8 score, requiring user interaction (opening an untrusted file) but no special privileges. The vulnerabilities affect the 3D engineering and finite element analysis tool used in critical manufacturing workflows worldwide.
No active exploitation in the wild has been reported. The attack surface is constrained to local file opening; these are not remotely exploitable. Mitigation requires updating to Simcenter Femap V2406.0003 or later, or V2412.0002 or later, and enforcing a policy against opening untrusted STP and BMP files. CISA's standard network segmentation and access controls apply.
Mentioned in this report
Detection guidance
Femap Spawning Command Shell or Script Interpreter
femap.exe launching cmd, PowerShell or script hosts, a possible sign of code execution after the user opened a malicious STP or BMP file (CVE-2025-40762 / CVE-2025-40764). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Femap Spawning Command Shell or Script Interpreter
description: Detects Siemens Simcenter Femap (femap.exe) spawning a command shell
or script interpreter. Femap does not normally need these, so this may indicate
memory-corruption exploitation via a malicious STP or BMP file (CVE-2025-40762,
CVE-2025-40764). Generalises on the parent/child relation, not on any file name.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \femap.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
filter_solver_helpers:
CommandLine|contains:
- nastran
- \Femap\
condition: selection and not filter_solver_helpers
falsepositives:
- Femap workflows or API scripts that call cmd.exe to launch external solvers or pre/post-processing
batch files
- Site-specific Femap automation that shells out to PowerShell
level: medium
id: abc57eb4-5f88-58e9-9d73-922f09bf7614
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-04
Femap Spawning Living-off-the-Land Binary
femap.exe spawning LOLBins commonly used to download or execute payloads, indicating likely exploitation through a malicious engineering or image file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Femap Spawning Living-off-the-Land Binary
description: Detects Siemens Simcenter Femap spawning binaries commonly abused to
download or proxy-execute payloads (mshta, rundll32, regsvr32, certutil, bitsadmin,
curl, msiexec). A CAD/FEA application has little reason to start these, so this
suggests post-exploitation after a malicious STP or BMP file was opened.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \femap.exe
Image|endswith:
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
- \msiexec.exe
condition: selection
falsepositives:
- Femap installer or licensing components invoking msiexec or rundll32 during updates
level: high
id: 212be019-745f-5376-930a-dd3c0836a14e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-04
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs