CVE-2026-64629: Parasolid X_T File RCE Vulnerability

CVE-2026-64629 Overview

CVE-2026-64629 is an out-of-bounds read vulnerability in Siemens Parasolid V38, a 3D geometric modeling kernel embedded in numerous computer-aided design (CAD) applications. The flaw resides in the component that parses X_T (Parasolid transmit) files. An attacker can craft a malicious X_T file that, when opened by a vulnerable application, triggers memory access outside the intended bounds. Successful exploitation allows code execution in the context of the current process. The issue is tracked under [CWE-125: Out-of-bounds Read] and is documented in the Siemens Security Advisory SSA-138516.

Critical Impact
Opening a specially crafted X_T file in an application using Parasolid V38.0 or V38.1 can lead to arbitrary code execution with the privileges of the user running the CAD process.

Affected Products

Siemens Parasolid V38.0 (all versions prior to V38.0.235)
Siemens Parasolid V38.1 (all versions prior to V38.1.230)
Downstream CAD, CAM, and CAE applications embedding the Parasolid V38 kernel

Discovery Timeline

2026-08-11 - CVE-2026-64629 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64629

Vulnerability Analysis

Parasolid is a geometric modeling kernel used by many commercial and enterprise CAD platforms to represent solids, surfaces, and wireframes. The X_T format is Parasolid's ASCII transmit file, used to exchange model data between applications. The vulnerability occurs during parsing of these X_T files, where the parser reads memory outside the bounds of an allocated buffer. This class of memory-safety defect [CWE-125] typically stems from insufficient validation of length, index, or offset fields that originate from attacker-controlled file content. When an out-of-bounds read is combined with the parser's downstream use of that data, an attacker can influence control flow and achieve arbitrary code execution in the CAD process.

Root Cause

The root cause is missing or insufficient bounds validation while processing structures inside an X_T file. The parser trusts size or offset fields supplied by the file and dereferences memory beyond the allocated region. Details of the specific parsing routine are not disclosed in the public advisory. See the Siemens Security Advisory SSA-138516 for vendor-provided information.

Attack Vector

Exploitation requires local delivery of a crafted X_T file and user interaction to open it. Typical delivery paths include phishing attachments, shared engineering repositories, third-party model libraries, and supply-chain distribution of CAD assets. Once the target opens the file, the malicious payload executes in the security context of the CAD user, which in engineering environments frequently includes access to intellectual property and network resources.

No public proof-of-concept exploit is currently available for CVE-2026-64629.

Detection Methods for CVE-2026-64629

Indicators of Compromise

Unexpected crashes or abnormal termination of CAD applications immediately after opening an .x_t or .xmt_txt file
CAD host processes spawning command interpreters such as cmd.exe, powershell.exe, or /bin/sh
Outbound network connections initiated by CAD processes to previously unseen external hosts
X_T files sourced from untrusted email attachments, external portals, or unverified model libraries

Detection Strategies

Monitor process creation events where a CAD parent process launches a shell, scripting engine, or LOLBin
Alert on writes to autorun locations, scheduled tasks, or startup folders initiated by CAD processes
Inspect file metadata and origin (Mark-of-the-Web on Windows) for X_T files opened by engineering workstations

Monitoring Recommendations

Enable EDR telemetry on engineering workstations and forward process, file, and network events to a central data lake
Track version inventory of Parasolid-based applications to identify hosts still running V38.0 < 235 or V38.1 < 230
Baseline normal CAD process behavior so anomalous child processes and network activity generate high-fidelity alerts

How to Mitigate CVE-2026-64629

Immediate Actions Required

Identify all engineering workstations and servers running applications that embed Parasolid V38.0 or V38.1
Upgrade Parasolid to V38.0.235 or V38.1.230 (or later) and rebuild or redistribute embedding applications
Restrict opening X_T files to those obtained from trusted, verified sources
Enforce least-privilege on CAD user accounts to limit the impact of code execution in the process context

Patch Information

Siemens has released fixed builds of the Parasolid kernel. Upgrade to Parasolid V38.0.235 or later for the V38.0 branch, and to V38.1.230 or later for the V38.1 branch. Refer to the Siemens Security Advisory SSA-138516 for authoritative fix guidance and downstream application updates.

Workarounds

Do not open X_T files received from untrusted or unverified sources
Process untrusted X_T files inside isolated virtual machines or sandboxed environments without access to sensitive data
Apply application allowlisting to block unauthorized child processes from CAD applications
Use email and web gateway policies to inspect or quarantine .x_t and .xmt_txt attachments

bash

# Example: block CAD applications from spawning shells via AppLocker or WDAC policy
# (adapt paths to the specific CAD product embedding Parasolid)
New-AppLockerPolicy -RuleType Path -User Everyone `
  -Action Deny `
  -Path "%SystemRoot%\System32\cmd.exe" `
  -Description "Block cmd.exe when launched by CAD processes"