Siemens Parasolid Vulnerability Exposes Industrial Control Systems to Out-of-Bounds Read Attacks

Siemens Parasolid Vulnerability Exposes Industrial Control Systems to Out-of-Bounds Read Attacks

Siemens has identified an out-of-bounds read vulnerability in its Parasolid software, which could allow an attacker to crash the application or execute arbitrary code. The company has released new versions to address the issue and recommends updating to the latest versions.

The affected applications contain an out-of-bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. The vulnerability is identified as CVE-2026-64629 and has a CVSS score of 7.8.

Siemens has released new versions for the affected products, including Parasolid V38.0 vers:intdot/<38.0.235 and Parasolid V38.1 vers:intdot/<38.1.230. The company recommends updating to the latest versions to minimize the risk of attacks.

In addition to updating to the latest versions, Siemens recommends protecting network access to devices with appropriate mechanisms. The company also recommends configuring the environment according to Siemens' operational guidelines for Industrial Security and following the recommendations in the product manuals.

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available.