CISA flags CVE-2026-64629 out-of-bounds read in Siemens Parasolid

The advisory, a verbatim republication of Siemens ProductCERT SSA-138516, covers CVE-2026-64629, an out-of-bounds read (CWE-125) in Parasolid V38.0 prior to V38.0.235 and V38.1 prior to V38.1.230. Successful exploitation through a specially crafted X_T file could allow an attacker to execute code in the context of the current process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the local attack surface and user-interaction requirement: an attacker needs a victim to open a malformed file, but once triggered the impact spans confidentiality, integrity, and availability.

This is at least the seventh CISA advisory for Parasolid since late 2022, and the vulnerability class (out-of-bounds read on X_T file parsing) has appeared in multiple prior advisories, including CVE-2024-32635, CVE-2024-26275, and CVE-2023-49125. The recurrence of the same CWE in the same parsing path across version lines suggests the X_T parser remains an attack surface worth monitoring for any organization that exchanges Parasolid design files with external parties.

Siemens ProductCERT reported the vulnerability to CISA. The advisory doesn't mention exploit code or active exploitation. Organizations running Parasolid in manufacturing or CAD workflows should apply the version-specific patches and, as a standing practice, treat X_T files from untrusted sources as potentially malicious.