As reported by CISA's ICS Advisory program (ICSA-26-225-10), Siemens Parasolid — a foundational geometric modeling kernel embedded in numerous CAD/CAM and PLM platforms — carries a high-severity out-of-bounds read vulnerability that deserves immediate attention from engineering and OT security teams alike.
Vulnerability at a Glance
- CVE ID
- CVE-2026-64629
- CVSS v3 Score / Severity
- 7.8 — High
- Vulnerability Type
- Out-of-Bounds Read (CWE-125) during X_T file parsing
- Affected Vendor
- Siemens
- Affected Products & Versions
-
- Parasolid V38.0 — all versions before 38.0.235
- Parasolid V38.1 — all versions before 38.1.230
- Patch Available?
- Yes — Siemens has released updated versions. Update to V38.0.235 or V38.1.230 or later.
- Active Exploitation Observed?
- Not reported at time of advisory. No known public proof-of-concept confirmed.
- Sectors at Risk
- Critical Manufacturing (globally deployed)
Why This Matters Beyond the Patch
Parasolid is not a consumer application — it is a deeply embedded geometric modeling kernel licensed by dozens of major CAD/CAM vendors, including Siemens NX, Solid Edge, and a wide range of third-party engineering tools. This means the attack surface for CVE-2026-64629 is far broader than a single product advisory might suggest. Any downstream application that ingests X_T files and relies on a vulnerable version of Parasolid is potentially exposed, even if the host application itself has not issued its own advisory yet.
The X_T file format is the native format of Parasolid and is routinely exchanged between suppliers, contractors, and engineering partners across the manufacturing supply chain. This creates a compelling social engineering vector: a threat actor could embed a malicious X_T file in a design file exchange, an email attachment, or a shared project repository, triggering code execution simply when an engineer opens what appears to be routine CAD data.
The attack scenario here is deceptively simple: craft a malicious X_T geometry file, deliver it to an engineer's workstation via supply chain, email, or collaboration platform, and achieve code execution in the context of the running process — with no additional user interaction beyond opening the file.
Who Is Most Exposed?
Engineering organizations in aerospace, automotive, defense, and industrial equipment manufacturing are at the highest risk. These environments typically:
The concern is not just workstation compromise — lateral movement from an engineer's machine into PLM or MES systems could have significant operational consequences, including IP theft or disruption of production workflows.
Shield53 Recommendations
Immediate Actions
- Patch now: Update all Parasolid V38.0 installations to 38.0.235 and V38.1 installations to 38.1.230. Consult your CAD vendor if Parasolid is embedded in a host application — they may need to release their own update packaging the fixed kernel.
- Inventory downstream exposure: Identify every application in your environment that uses Parasolid as a modeling kernel. Don't wait for host vendors — proactively query them for patch timelines if they haven't published guidance.
- Restrict X_T file ingestion: Until patching is complete, implement controls to limit X_T file processing to trusted, vetted sources. Consider sandboxing or CDR (Content Disarm and Reconstruction) for externally received CAD files.
- Audit file exchange workflows: Review how X_T files enter your environment — email, shared drives, supplier portals, collaboration tools. Add inspection or quarantine steps where feasible.
- Enhance endpoint detection on CAD workstations: Ensure EDR agents are deployed and tuned on engineering workstations. Create detection rules for unusual child process spawning from CAD applications.
- Segment engineering networks: Ensure CAD workstations cannot directly reach OT/ICS network segments. Treat the engineering LAN as a semi-trusted zone requiring explicit controls to adjacent systems.
Longer-Term Posture
Manufacturing organizations should treat CAD and PLM environments with the same rigor applied to OT systems. File format vulnerabilities in engineering kernels are a historically underappreciated attack surface — and one increasingly on the radar of nation-state actors targeting intellectual property in defense and advanced manufacturing sectors. A mature vendor risk management process should include tracking Parasolid and similar kernel versioning as part of your software bill of materials (SBOM).
