5 minhigh
Siemens Parasolid (CVE-2026-64629)
Siemens Parasolid V38.0 and V38.1 are affected by an out-of-bounds read vulnerability (CVE-2026-64629) that is triggered when the application parses specially crafted X_T format files. The flaw allows an attacker to crash the application or execute arbitrary code with the privileges of the current process. Siemens has released fixed versions V38.0.235 and V38.1.230.
Sens:▲ 24hConf:high
Showing defanged values
- cveCVE-2026-64629Out-of-bounds read vulnerability while parsing specially crafted X_T files allows an attacker to execute code in the context of the current process or crash the application.
Detection / Hunteropenrouter
What Happened
Siemens found a security flaw in its Parasolid 3D modeling software. If someone opens a specially crafted file in the X_T format, the software can crash or an attacker could run unwanted code on the computer. The risk is rated high. Anyone using Parasolid versions V38.0 or V38.1 should update to the latest fixed versions (V38.0.235 or V38.1.230) as soon as possible. Organizations should also limit network access to systems running this software.
Key Takeaways
- Siemens Parasolid V38.0 and V38.1 contain an out-of-bounds read vulnerability (CVE-2026-64629) triggered by parsing specially crafted X_T files
- The vulnerability allows an attacker to crash the application or execute arbitrary code in the context of the current process
- CVSS v3.1 score is 7.8 (High) with local attack vector and user interaction required
- Fixed versions are V38.0.235 and V38.1.230 respectively
- Critical Manufacturing sector is identified as an affected critical infrastructure sector
Affected Systems
- Siemens Parasolid V38.0 versions prior to V38.0.235
- Siemens Parasolid V38.1 versions prior to V38.1.230
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-64629 | Siemens Parasolid | High (7.8) | Out-of-bounds read vulnerability while parsing specially crafted X_T files allows an attacker to execute code in the context of the current process or crash the application. |
Attack Chain
- Initial Access: Attacker delivers a specially crafted X_T file to a user, likely via email or shared storage
- Execution: User opens the malicious X_T file in an application using the Siemens Parasolid kernel
- Exploitation: The Parasolid parser triggers an out-of-bounds read while parsing the malformed file
- Impact: The application crashes or arbitrary code executes in the context of the current process
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisory. The article is a vendor patch advisory with remediation guidance only.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The vulnerability is triggered by file parsing within a legitimate application. EDR may observe a process crash or subsequent suspicious child process execution but the initial trigger is indistinguishable from normal file-open behavior. |
| Network Visibility | None | The exploit is entirely local, requiring user interaction to open a crafted file. No network communication is needed to trigger the vulnerability. |
| Detection Difficulty | Hard | Detecting exploitation of a file-parsing out-of-bounds read requires memory-level telemetry or behavioral detection of post-exploitation activity. The initial parsing event appears as normal application usage. |
Required Log Sources
- Endpoint process creation logs
- Application crash logs
- File access logs for X_T file types
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Parasolid-based applications spawning unexpected child processes after opening a file, which could indicate successful exploitation of CVE-2026-64629. | Process creation and process ancestry logs from EDR or Sysmon Event ID 1 | Execution | Medium — legitimate CAD or PLM applications may spawn helper processes during normal file processing |
| Consider hunting for repeated application crashes in Parasolid-based products, which could indicate attempts to exploit the out-of-bounds read vulnerability. | Application crash logs, Windows Event Log application errors, EDR crash telemetry | Exploitation | High — application crashes occur during normal operation with corrupt or incompatible files |
Control Gaps
- File-based exploit detection for legitimate application parsers
- Memory-level exploit detection within trusted processes
Key Behavioral Indicators
- Unexpected child processes spawned by applications embedding the Parasolid kernel
- Application crashes in Parasolid-based products immediately following file-open events
- X_T files received from external or untrusted sources
False Positive Assessment
High — the vulnerability is triggered by opening a file in a legitimate application, and application crashes can occur during normal operation with corrupt or incompatible files.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider updating Siemens Parasolid V38.0 to V38.0.235 or later and V38.1 to V38.1.230 or later as soon as possible.
- Consider restricting the opening of X_T files to only those received from trusted sources until the update is applied.
Infrastructure Hardening
- Consider minimizing network exposure for all control system devices and ensuring they are not accessible from the internet.
- Evaluate whether control system networks can be isolated from business networks using firewalls.
- If remote access is required, consider using secure VPN methods and ensure VPN software is updated to the latest version.
User Protection
- Consider deploying endpoint detection that alerts on unexpected child process creation from CAD or PLM applications.
- If supported by your tooling, consider application-level controls that restrict which directories Parasolid-based applications can write to or execute from.
Security Awareness
- Consider reminding users not to open X_T files from untrusted or unknown sources.
- Consider incorporating this advisory into existing awareness programs for engineering and manufacturing teams that use Siemens Parasolid-based tools.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping1 technique
Tactic
