Siemens Patches High-Severity Flaw in Parasolid 3D Modelling Engine
A memory-handling bug in Siemens Parasolid, tracked as CVE-2026-64629, lets a booby-trapped design file crash the host application or run attacker code. Siemens has shipped fixed builds.
Key points
- Siemens fixed a high-severity flaw in its Parasolid 3D modelling engine, tracked as CVE-2026-64629, on 11 August 2026.
- The bug scores 7.8 out of 10 on the industry severity scale and can crash the host application or run attacker code.
- Only opening a malicious X_T design file is needed to trigger it, so the risk sits with engineers and designers.
- Patched versions are Parasolid 38.0.235 and 38.1.230; earlier builds in those branches are vulnerable.
- Siemens ProductCERT reported the flaw to the US Cybersecurity and Infrastructure Security Agency, which republished the advisory on 13 August 2026.
Siemens has patched a memory-safety bug in Parasolid, the geometric modelling engine that sits underneath a long list of computer-aided design tools used in manufacturing.
The flaw, tracked as CVE-2026-64629, is an out-of-bounds read. In plain English, the software reads memory it was never meant to touch when it opens a specially crafted design file. That mistake can either crash the program or, in the worst case, let an attacker run their own code on the engineer's machine.
The trigger is a malicious X_T file, the native exchange format for Parasolid models. An engineer only needs to open one for the bug to fire.
Who is actually at risk?
Anyone running a CAD or simulation product built on Parasolid 38.0 before 38.0.235, or 38.1 before 38.1.230. Parasolid is not an app most people click on directly. It is a library baked into other engineering software, which means the exposure follows wherever that software is installed, typically the workstations of mechanical engineers and industrial designers.
Siemens is headquartered in Germany and the advisory notes deployment worldwide, in critical manufacturing environments.
How bad is it?
The bug carries a severity score of 7.8 out of 10 on the CVSS scale, which vendors use to rank how dangerous a flaw is. That puts it in the "high" band, one step below critical.
One detail keeps it from being worse: the attack needs local access and user interaction. Someone has to open the poisoned file. There is no evidence of exploitation in the wild, and the advisory does not tie the flaw to any known intrusion set. Capability is one thing, intent another. Right now this is a patching job, not an active incident.
That said, malicious CAD files are a known lure in industrial espionage. Groups such as the cluster Mandiant tracks as APT41 and the activity Dragos labels CHERNOVITE have historically shown interest in engineering software as a way into manufacturing networks. No one is attributing this bug to them. It is worth remembering the pattern.
What Siemens is telling customers
Update. The fixes are in Parasolid 38.0.235 and Parasolid 38.1.230, available through Siemens support.
| Product branch | Vulnerable versions | Fixed in |
|---|---|---|
| Parasolid V38.0 | Below 38.0.235 | 38.0.235 |
| Parasolid V38.1 | Below 38.1.230 | 38.1.230 |
Siemens ProductCERT reported the flaw to CISA, the US Cybersecurity and Infrastructure Security Agency, which republished the advisory on 13 August 2026 as a straight conversion of Siemens bulletin SSA-138516.
Beyond the patch, Siemens repeats its standard operational-technology guidance: keep engineering workstations off the open internet, put control-system networks behind firewalls, and treat any remote access route as something that itself needs hardening.
What should ordinary staff do?
If you work with CAD files, be wary of X_T files arriving by email or download from suppliers you were not expecting. Confirm with the sender through a second channel before opening. That single habit blunts most file-format attacks.
