Our takeSiemens patched an out-of-bounds read in Parasolid (malicious X_T files) and two BMP-parsing flaws in Simcenter Femap — a crafted file can crash the app or execute code. Update now if you run either; shops without Siemens CAD/simulation tooling can skip this one.Cyber Resilience desk
Sources (4)
- cisa_advisories · cisa_advisories
- cisa_advisories · cisa_advisories
- cisa_advisories · cisa_advisories
- cisa_ics · cisa_ics
What this means for you — Security leader:Update all Siemens Parasolid and Simcenter Femap deployments to the latest versions; the out-of-bounds read (Parasolid) and BMP parsing flaws (Femap) can lead to crashes or arbitrary code execution on malicious files.
What this means for you — Lean IT orgs:If you use Siemens Parasolid or Simcenter Femap, install the newest versions right away. Most teams without these tools can ignore this.
What this means for you — MSP:Check client environments for Siemens Parasolid and Simcenter Femap; push the vendor's latest versions to mitigate out-of-bounds read and BMP parsing vulnerabilities that risk crashes or code execution.
What this means for you — Researcher:Siemens released fixes for an out-of-bounds read in Parasolid (X_T files) and two BMP parsing flaws in Simcenter Femap; both can enable crashes or arbitrary code execution via crafted files.