Siemens Parasolid Out-of-Bounds Read Vulnerability (CVE-2026-64629)

Siemens Parasolid, the geometric modeling kernel used across Siemens' CAD and engineering software portfolio, contains an out-of-bounds read vulnerability identified as CVE-2026-64629. According to the advisory published through CISA, the vulnerability is triggered when the application reads files in X_T format. A specially crafted X_T file could cause the application to read beyond the bounds of allocated memory, potentially leading to a crash or arbitrary code execution in the context of the current process.

The vulnerability affects Parasolid V38.0 versions earlier than 38.0.235 and Parasolid V38.1 versions earlier than 38.1.230. The CVSS v3.1 base score is 7.8, classified as HIGH, with the vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is local, requiring low complexity and user interaction, and the attacker must have no prior privileges.

Siemens ProductCERT reported the vulnerability to CISA. Siemens has released vendor fixes and recommends updating to Parasolid V38.0.235 or later for the V38.0 branch, and V38.1.230 or later for the V38.1 branch. The advisory notes that the vulnerability was reported via the Common Security Advisory Framework (CSAF) and is provided "as-is" for informational purposes. Siemens also recommends protecting network access to devices and following operational guidelines for industrial security.