Siemens Patches High-Severity Flaw in Parasolid 3D Modelling Engine
A memory-handling bug in Siemens Parasolid, tracked as CVE-2026-64629, lets a booby-trapped design file crash the host application or run attacker code. Siemens has shipped fixed builds.
Key points
- Siemens fixed a high-severity flaw in its Parasolid 3D modelling engine, tracked as CVE-2026-64629, on 11 August 2026.
- The bug scores 7.8 out of 10 on the industry severity scale and can crash the host application or run attacker code.
- Only opening a malicious X_T design file is needed to trigger it, so the risk sits with engineers and designers.
- Patched versions are Parasolid 38.0.235 and 38.1.230; earlier builds in those branches are vulnerable.
- Siemens ProductCERT reported the flaw to CISA, the US agency that republished the advisory on 13 August 2026.
Siemens has patched a memory-safety bug in Parasolid, the geometric modelling engine that sits underneath a long list of computer-aided design tools used in manufacturing.
The flaw, tracked as CVE-2026-64629, is an out-of-bounds read. The software reads memory it was never meant to touch when it opens a specially crafted design file. That mistake can crash the program or, in the worst case, let an attacker run their own code on the engineer's machine.
The trigger is a malicious X_T file, the native exchange format for Parasolid models. An engineer only needs to open one.
Who is actually at risk?
Anyone running a CAD or simulation product built on Parasolid 38.0 before 38.0.235, or 38.1 before 38.1.230. Parasolid isn't an app most people click on directly. It's a library baked into other engineering software, which means the exposure follows wherever that software is installed: typically the workstations of mechanical engineers and industrial designers. Siemens is headquartered in Germany; the advisory notes deployment worldwide in critical manufacturing environments.
How bad is it?
The bug carries a CVSS score of 7.8 out of 10, putting it in the high-severity band, one step below critical.
One detail keeps it from being worse: the attack needs local access and user interaction. Someone has to open the poisoned file. There's no evidence of exploitation in the wild, and the advisory doesn't tie the flaw to any known intrusion set. Right now this is a patching job, not an active incident.
Malicious CAD files are a documented lure in industrial espionage, and the pattern is worth remembering. Our August 2026 ICS Patch Tuesday roundup covered a separate Siemens flaw that week scoring the maximum possible severity, a reminder that this advisory didn't arrive in isolation.
What Siemens is telling customers
Update. The fixes are in Parasolid 38.0.235 and Parasolid 38.1.230, available through Siemens support.
| Product branch | Vulnerable versions | Fixed in |
|---|---|---|
| Parasolid V38.0 | Below 38.0.235 | 38.0.235 |
| Parasolid V38.1 | Below 38.1.230 | 38.1.230 |
Siemens ProductCERT reported the flaw to CISA. CISA's publication on 13 August 2026 was a straight conversion of Siemens bulletin SSA-138516.
Beyond the patch, Siemens repeats its standard operational-technology guidance: keep engineering workstations off the open internet, put control-system networks behind firewalls, and treat any remote access route as something that itself needs hardening.
What should ordinary staff do?
If you work with CAD files, be wary of X_T files arriving by email or from suppliers you weren't expecting. Confirm with the sender through a second channel before opening. That single habit blunts most file-format attacks.
Capability is one thing, intent another. The advisory says nothing about active exploitation, but engineering workstations are a known target in manufacturing-sector intrusions. Patch first, then audit which users in your organisation can receive and open external design files.
