Source context: this article examines information published by the source on August 13, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
Siemens Parasolid contains an out-of-bounds read vulnerability (CWE-125), identified as CVE-2026-64629. This flaw is triggered during the parsing of specially crafted X_T files. If exploited, the vulnerability could result in an application crash or allow an attacker to execute arbitrary code within the context of the current process.
Exposure and applicability
This vulnerability specifically affects users of Siemens Parasolid within the critical manufacturing sector. The risk is present in the following versions:
* Parasolid V38.0 versions prior to V38.0.235
* Parasolid V38.1 versions prior to V38.1.230
Based on the provided technical data, this is not a remote network-based attack; it requires local access or user interaction to trigger the flaw via the processing of a malicious file.
Remediation priorities
Our analysis suggests that asset owners and controls engineers should prioritize updating the software to eliminate the underlying vulnerability. The following versions are identified as containing the fix:
* For V38.0 users: Update to V38.0.235 or later.
* For V38.1 users: Update to V38.1.230 or later.
In addition to patching, we recommend reviewing the provenance of X_T files entering the environment. Because the trigger is a specially crafted file, restricting the import of files from untrusted sources could reduce the likelihood of exploitation while updates are being scheduled.
How to validate remediation
To verify that the risk has been reduced, administrators should perform a version check on all engineering workstations and systems utilizing Parasolid to ensure they meet or exceed the minimum versions listed above (V38.0.235 or V38.1.230).
Note that while a version check confirms the application of the patch, it does not guarantee total security against other undiscovered flaws; however, it specifically addresses CVE-2026-64629.
Limits and open questions
It remains unknown if there are any known exploits currently active in the wild. Furthermore, while Siemens recommends protecting network access to devices as a general measure, this specific vulnerability is triggered by file parsing rather than direct network packets. The primary residual risk remains the potential for a user to inadvertently open a malicious X_T file provided by an external party.
Source and editorial note
Siemens Parasolid · Source date: August 13, 2026 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗