Siemens Parasolid users should review affected installations and update to a fixed release after the Cybersecurity and Infrastructure Security Agency published an advisory for a vulnerability in the software’s handling of specially crafted X_T files. The issue, tracked as CVE-2026-64629, is an out-of-bounds read that could allow an attacker to crash the application or execute arbitrary code in the context of the current process, according to the CISA advisory.
The advisory identifies Siemens Parasolid V38.0 and V38.1 as affected versions. Siemens has released newer versions for both branches and recommends updating to the latest available versions. The listed fixes are V38.0.235 or later for the V38.0 branch and V38.1.230 or later for the V38.1 branch.
The vulnerability occurs while an affected application parses X_T files. CISA describes the condition as an out-of-bounds read, classified under CWE-125. In an out-of-bounds read, software accesses data outside the memory area expected for the operation. Depending on how the flaw is triggered and handled, that behavior can cause an application failure or contribute to code execution. CISA and Siemens identify both a possible application crash and arbitrary-code execution as outcomes of this vulnerability.
The advisory says that arbitrary code could execute in the context of the current process. That means the affected application’s process is the context identified by the notice. The advisory does not provide a broader description of resulting system impact, affected workflows, or particular applications that incorporate Parasolid. It identifies the vulnerable component, the affected branches, the file format involved and the possible technical outcomes.
CVE-2026-64629 carries a CVSS 3.1 base score of 7.8 and a high severity rating. The published vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The advisory lists the vulnerability as an out-of-bounds read and names Siemens as the vendor. Siemens ProductCERT reported the issue to CISA.
The CISA notice was published on Aug. 13, 2026. It identifies itself as a republication of Siemens ProductCERT advisory SSA-138516 and says the notice was converted from the vendor’s Common Security Advisory Framework advisory. The initial release date shown in the notice is Aug. 11, 2026.
For remediation, organizations should identify whether they have Parasolid V38.0 or V38.1 installations and compare those versions with the fixed-release thresholds listed in the advisory. V38.0 installations should be updated to V38.0.235 or later. V38.1 installations should be updated to V38.1.230 or later. Siemens and CISA recommend updating affected products to the latest versions.
CISA places the advisory in the critical manufacturing category and lists deployments as worldwide. Those fields describe the sector and geographic scope associated with the advisory. The notice does not identify a specific affected organization, incident or compromise. It also does not state that the vulnerability is being exploited in the wild.
The advisory does not provide a named affected application beyond Siemens Parasolid. It also does not provide a proof-of-concept, indicators of compromise or a detailed exploitation procedure. Its technical description is limited to the parsing of specially crafted X_T files and the resulting potential for an application crash or execution of arbitrary code.
Alongside the update recommendation, CISA advises organizations to minimize network exposure for control-system devices and systems and to ensure they are not accessible from the internet. It recommends placing control-system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, CISA recommends more secure methods such as virtual private networks, while noting that VPNs may have vulnerabilities and should be kept current.
CISA also advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures. The agency encourages organizations to implement recommended cybersecurity strategies for proactive defense of industrial control systems. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation.
The central remediation decision for this advisory is version review and updating. The affected branches are Parasolid V38.0 and V38.1, and the notice gives specific fixed versions for each. Organizations that use those branches can use the published thresholds to determine whether an installation has reached a listed fixed release. The advisory’s update recommendation applies to the affected Siemens Parasolid versions identified in the notice.