# Siemens Simcenter Femap buffer overflows via STP BMP files

Published: 2025-08-14 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/b577c060-d78d-5ec4-87ac-0ae455cb21ee/siemens-simcenter-femap-buffer-overflows-via-stp-bmp-files

> Two buffer overflow bugs in Siemens Simcenter Femap allow code execution when parsing specially crafted STP or BMP files.

Siemens Simcenter Femap versions 2406 and 2412 contain two memory corruption vulnerabilities that could allow local code execution. CVE-2025-40762 is an out-of-bounds write triggered by parsing a malicious STP file, while CVE-2025-40764 is an out-of-bounds read in BMP file parsing. Both carry a CVSS 7.8 score, requiring user interaction (opening an untrusted file) but no special privileges. The vulnerabilities affect the 3D engineering and finite element analysis tool used in critical manufacturing workflows worldwide.

No active exploitation in the wild has been reported. The attack surface is constrained to local file opening; these are not remotely exploitable. Mitigation requires updating to Simcenter Femap V2406.0003 or later, or V2412.0002 or later, and enforcing a policy against opening untrusted STP and BMP files. CISA's standard network segmentation and access controls apply.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40762, CVE-2025-40764

## Detection guidance (public sample)

### Femap Spawning Command Shell or Script Interpreter

ATT&CK: T1204.002

femap.exe launching cmd, PowerShell or script hosts, a possible sign of code execution after the user opened a malicious STP or BMP file (CVE-2025-40762 / CVE-2025-40764). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Femap Spawning Command Shell or Script Interpreter
description: Detects Siemens Simcenter Femap (femap.exe) spawning a command shell
  or script interpreter. Femap does not normally need these, so this may indicate
  memory-corruption exploitation via a malicious STP or BMP file (CVE-2025-40762,
  CVE-2025-40764). Generalises on the parent/child relation, not on any file name.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \femap.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
  filter_solver_helpers:
    CommandLine|contains:
    - nastran
    - \Femap\
  condition: selection and not filter_solver_helpers
falsepositives:
- Femap workflows or API scripts that call cmd.exe to launch external solvers or pre/post-processing
  batch files
- Site-specific Femap automation that shells out to PowerShell
level: medium
id: abc57eb4-5f88-58e9-9d73-922f09bf7614
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-04
```

### Femap Spawning Living-off-the-Land Binary

ATT&CK: T1204.002

femap.exe spawning LOLBins commonly used to download or execute payloads, indicating likely exploitation through a malicious engineering or image file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Femap Spawning Living-off-the-Land Binary
description: Detects Siemens Simcenter Femap spawning binaries commonly abused to
  download or proxy-execute payloads (mshta, rundll32, regsvr32, certutil, bitsadmin,
  curl, msiexec). A CAD/FEA application has little reason to start these, so this
  suggests post-exploitation after a malicious STP or BMP file was opened.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \femap.exe
    Image|endswith:
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Femap installer or licensing components invoking msiexec or rundll32 during updates
level: high
id: 212be019-745f-5376-930a-dd3c0836a14e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b577c060-d78d-5ec4-87ac-0ae455cb21ee/siemens-simcenter-femap-buffer-overflows-via-stp-bmp-files.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup