Simcenter Femap contains a vulnerability classified as CWE-125 (out-of-bounds read) affecting all versions before V2606.0001. The issue arises during the parsing of specially crafted BMP files, potentially enabling remote code execution in the context of the running application. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. There is no information about known exploits in the wild or vendor-provided patches.

Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the user running Simcenter Femap, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system as indicated by the CVSS vector. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted BMP files with Simcenter Femap and apply standard security best practices to limit exposure.