Specially crafted X_T files trigger arbitrary code execution in Siemens Parasolid software
A high-severity out of bounds read vulnerability in Siemens Parasolid could allow an attacker to execute arbitrary code or crash the application. The flaw is triggered when parsing specially crafted `X_T` files. Update your Parasolid installations to the latest patched versions immediately to mitigate this risk. 🛡️
Summary
Siemens has disclosed a critical vulnerability affecting its Parasolid geometry modeling engine. The flaw, identified as CVE-2026-64629, resides in how the software parses X_T format files. An attacker providing a specially crafted file could trigger an out of bounds read, potentially leading to arbitrary code execution within the context of the current process or causing the application to crash.
The vulnerability impacts specific versions of Parasolid V38.0 and V38.1. Because this flaw occurs during the parsing of external files, it poses a significant risk whenever users interact with untrusted geometry data.
Technical details
The core of the issue is an out of bounds read vulnerability. This type of memory corruption occurs when the application attempts to read data past the end of the intended buffer while processing X_T files.
If successful, this memory error allows for two primary outcomes:
- Arbitrary Code Execution: An attacker may be able to execute code in the context of the running process.
- Denial of Service: The vulnerability can be used to crash the application entirely.
The technical specifics regarding the exact memory offset or the precise mechanism of the overflow are not yet public.
Affected products and fixed versions
The vulnerability affects several versions of the Parasolid engine. Users should verify their current versioning against the following list:
| Product Version | Fixed Version |
|---|---|
| Parasolid V38.0 (All versions < V38.0.235) | V38.0.235 or later |
| Parasolid V38.1 (All versions < V38.1.230) | V38.1.230 or later |
Defender guidance
To mitigate the risk of exploitation, Siemens recommends several layers of defense:
Immediate Remediation Update all affected Parasolid installations to the latest available versions as specified in the version table above. This is the primary method for resolving the underlying memory corruption flaw.
Network and Environment Hardening
- Protect network access to devices using appropriate security mechanisms.
- Configure your environment according to Siemens' operational guidelines for Industrial Security.
- Follow specific recommendations found in your product manuals to maintain a protected IT environment.
The risk is highest when users ingest X_T files from untrusted or external sources. Restricting file-sharing workflows and verifying the integrity of geometry data before processing can reduce the attack surface.
Sources
