Siemens Parasolid: X_T File Vulnerability Could Lead to Code Execution

The flaw affects CAD file parsing

Siemens has fixed a high-severity vulnerability in Parasolid, the component used to process geometric models and CAD files. The issue occurs when specially crafted X_T files are read.

The vulnerability, tracked as CVE-2026-64629, is classified as CWE-125, or an out-of-bounds read. A file crafted to trigger the flaw could crash the application or, under certain conditions, allow arbitrary code execution.

The Siemens ProductCERT advisory was published on August 11, 2026. CISA republished it on August 13, 2026, increasing the advisory’s visibility in the context of industrial systems. The product is associated with the critical manufacturing sector and is used worldwide.

Affected versions and fixed releases

The following versions are affected:

• Siemens Parasolid V38.0 versions earlier than V38.0.235;
• Siemens Parasolid V38.1 versions earlier than V38.1.230.

Versions V38.0.235 and V38.1.230 are the thresholds Siemens identifies for moving out of the affected branches. However, the vendor recommends installing the latest available release rather than stopping at these minimum versions.

The product status is classified as known_affected. This is therefore not a theoretical issue involving unidentified components: the advisory explicitly links the flaw to the two Parasolid branches listed above.

No other affected versions have been disclosed within the scope of the advisory.

How the vulnerability can be exploited

The flaw is triggered when Parasolid parses an X_T file prepared by an attacker. During processing, the component may read data beyond the intended memory area, accessing information outside the valid buffer.

The most immediate effect is an application crash. In a more serious scenario, memory manipulation could be exploited to execute arbitrary code within the process reading the file.

The CVSS 3.1 score is 7.8, with HIGH severity, based on the following vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The score describes an attack requiring local access to the system but no prior privileges. The attack complexity is low and user interaction is required, such as opening, importing, or processing a malicious X_T file.

The potential impact is high across all three core security objectives:

• confidentiality, because the process could access data available within its context;
• integrity, because executed code could modify files, configurations, or processing results;
• availability, because the application or system could be disrupted.

The scope remains unchanged: the attack operates within the context of the vulnerable process. The actual impact therefore depends on the privileges assigned to the application and the environment in which it runs.

Who is at risk and why the X_T format matters

The risk primarily affects workstations and industrial systems that receive, import, or convert Parasolid models in X_T format. An apparently ordinary file can become an attack vector if it comes from an unverified source or is exchanged through uncontrolled channels.

In a design environment, opening the file could compromise the operator’s workstation. If Parasolid is integrated into an application with access to engineering repositories, production systems, or network resources, the impact could extend to data and services accessible to that process.

The critical manufacturing sector increases the operational value of these systems. A successful attack could disrupt design or manufacturing activities, alter technical data, or provide a foothold for further actions across the corporate or OT network.

The brief does not indicate active exploitation campaigns, confirmed compromises, or specific technical indicators to search for. It is also unknown whether CVE-2026-64629 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog; consequently, no associated KEV deadline is available. Based on the available information, no recent Siemens entries in the KEV catalog are known either.

Updates and containment measures

The primary mitigation is to update Parasolid to at least:

• V38.0.235;
• V38.1.230;

or to a later version recommended by Siemens.

Before deployment in industrial environments, organizations should assess compatibility, dependencies, and operational impact. The update should be tested in a controlled environment, especially when Parasolid is embedded in CAD applications or production workflows.

In the meantime, organizations should:

• avoid opening X_T files from untrusted senders or repositories;
• subject files to internal checks before importing them;
• restrict the privileges of applications that process technical models;
• protect network access to affected systems;
• configure environments according to Siemens Industrial Security guidelines;
• keep OT networks separate from corporate networks and reduce direct Internet exposure.

CISA also recommends placing control devices and remote access behind firewalls and using up-to-date VPNs when remote access is required. However, a VPN is not a standalone security measure: connected devices and the software handling the connection may also contain vulnerabilities.

Any suspicious activity should be handled according to internal incident response procedures. Siemens directs users to its industrial security resources and ProductCERT service for further information and advisory updates.